WatchGuard discloses seven critical Fireware OS flaws enabling remote code execution
Supplied data names Fireware OS 2026.4 and 12.12.4 as fixes; this report does not establish exploitation.
74
Product
Fireware OS
- Mentions · 7d2
- Mentions · 30d2
- All mentions9
- First seenAug 31, 2026
- Last mentioned1d ago
Timeline
9 articles · newest firstWatchGuard Fireware OS and SSL VPN client affected by vulnerabilities
Canada’s October 28 notice lists Fireware OS and Mobile VPN with SSL Client builds before 2026.4 and 12.0, without naming CVEs.
38
WatchGuard fixes critical Fireware OS flaw allowing remote code execution
WatchGuard patched 15 Fireware OS bugs, including critical root RCE CVE-2026-86131 on Firebox VPN clients.
67
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
WatchGuard patched critical Fireware OS code injection that could give remote attackers root on Firebox appliances.
68
ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability
Authenticated stack buffer overflow in WatchGuard Fireware OS spamd allows remote code execution (CVE-2026-18145).
54
ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
WatchGuard Fireware OS samld deserialization flaw CVE-2026-13046 can yield remote code execution after a write precondition.
52
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA confirms ransomware gangs are exploiting critical unauthenticated RCE CVE-2025-14733 in WatchGuard Firebox firewalls, with roughly 9,000 devices still unpatched.
80
ZDI-26-632: WatchGuard FireWare OS epm connect Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a CVSS 8.8 unauthenticated stack-based buffer overflow in WatchGuard FireWare OS epm connect enabling network-adjacent remote code execution.
35
WatchGuard security advisory (AV26-865)
Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.
32
Related CVEs
by mentions- Root code injection in WatchGuard Fireware BOVPN Over TLS
- CVE-2025-1473329%9.3Unauthenticated Out-of-Bounds Write RCE in WatchGuard Fireware OS
- CVE-2025-924292%9.3Out-of-Bounds Write in WatchGuard Fireware OS iked Enables Unauthenticated RCE
- CVE-2022-2317611%8.8Privilege Escalation in WatchGuard Firebox/XTM Fireware OS
- CVE-2026-13086<1%9.3Unauthenticated Stack Buffer Overflow RCE in WatchGuard Fireware OS epm Service
- Unauthenticated API session flaw in WatchGuard access points
- Heap buffer overflow in Fireware OS AD authentication
- Unauthenticated stack buffer overflow in Fireware OS SIP proxy
- Stack buffer overflow in WatchGuard Fireware spamBlocker
- Deserialization code execution in WatchGuard Fireware samld
Appears with
- WatchGuardvendor · 9
- Fireboxproduct · 4
- Zero Day Initiativeorganization · 3
- Canadian Centre for Cyber Securityorganization · 2
- WatchGuardorganization · 2
- Dimensionproduct · 1
- Canadian Centre for Cyber Securityvendor · 1
- Windows Mobile VPN with SSLproduct · 1
- WatchGuard Access Pointproduct · 1
- CISAorganization · 1
- Mobile VPN with SSL Clientproduct · 1
- Shadowserverorganization · 1
- Zero Day Initiativevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.