WatchGuard discloses seven critical Fireware OS flaws enabling remote code execution
Supplied data names Fireware OS 2026.4 and 12.12.4 as fixes; this report does not establish exploitation.
74
Vendor
WatchGuard
- Mentions · 7d2
- Mentions · 30d5
- All mentions16
- First seenAug 21, 2026
- Last mentioned2d ago
Timeline
16 articles · newest firstWatchGuard Fireware OS and SSL VPN client affected by vulnerabilities
Canada’s October 28 notice lists Fireware OS and Mobile VPN with SSL Client builds before 2026.4 and 12.0, without naming CVEs.
38
Fake WatchGuard VPN Site Steals Credentials
Huntress found a WatchGuard lookalike that phished VPN server, login, and password via SEO poisoning.
72
Critical WatchGuard Endpoint Security Flaw Exposes Kernel and Process Memory
CVE-2026-13043 lets local users bypass WatchGuard's PSKMAD driver checks and read kernel and process memory.
66
WatchGuard security advisory (AV26-990)
WatchGuard Endpoint Security kernel driver flaw CVE-2026-13043 allows arbitrary kernel memory access.
66
WatchGuard fixes critical Fireware OS flaw allowing remote code execution
WatchGuard patched 15 Fireware OS bugs, including critical root RCE CVE-2026-86131 on Firebox VPN clients.
67
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
WatchGuard patched critical Fireware OS code injection that could give remote attackers root on Firebox appliances.
68
ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
WatchGuard Fireware OS samld deserialization flaw CVE-2026-13046 can yield remote code execution after a write precondition.
52
ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability
Authenticated stack buffer overflow in WatchGuard Fireware OS spamd allows remote code execution (CVE-2026-18145).
54
Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands
WatchGuard patched two unauthenticated critical AP flaws enabling remote command execution and API access.
78
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA confirms ransomware gangs are exploiting critical unauthenticated RCE CVE-2025-14733 in WatchGuard Firebox firewalls, with roughly 9,000 devices still unpatched.
80
ZDI-26-632: WatchGuard FireWare OS epm connect Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a CVSS 8.8 unauthenticated stack-based buffer overflow in WatchGuard FireWare OS epm connect enabling network-adjacent remote code execution.
35
The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced
GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.
15
WatchGuard security advisory (AV26-865)
Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.
32
WatchGuard security advisory (AV26-847)
Canada's Cyber Centre advises that WatchGuard Agent versions before 1.25.13.0000 are affected by vulnerabilities and urges administrators to apply updates.
20
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
48
Related CVEs
by mentions- OS command injection in WatchGuard AP internal API
- CVE-2026-13043<1%9.3Missing authentication in WatchGuard PSKMAD kernel driver
- Unauthenticated API session flaw in WatchGuard access points
- Root code injection in WatchGuard Fireware BOVPN Over TLS
- CVE-2025-924292%9.3Out-of-Bounds Write in WatchGuard Fireware OS iked Enables Unauthenticated RCE
- CVE-2025-1473329%9.3Unauthenticated Out-of-Bounds Write RCE in WatchGuard Fireware OS
- CVE-2022-2317611%8.8Privilege Escalation in WatchGuard Firebox/XTM Fireware OS
- CVE-2026-13086<1%9.3Unauthenticated Stack Buffer Overflow RCE in WatchGuard Fireware OS epm Service
- Unauthenticated stack buffer overflow in Fireware OS SIP proxy
- Deserialization code execution in WatchGuard Fireware samld
Appears with
- Fireware OSproduct · 9
- Fireboxproduct · 4
- WatchGuardorganization · 4
- Canadian Centre for Cyber Securityorganization · 4
- Microsoftvendor · 4
- Zero Day Initiativeorganization · 3
- WatchGuard Endpoint Securityproduct · 2
- Acronisvendor · 1
- Windows Mobile VPN with SSLproduct · 1
- CrowdStrike Falconproduct · 1
- SentinelOnevendor · 1
- Microsoft Defenderproduct · 1
- Cruciferrathreat actor · 1
- Grandoreirothreat actor · 1
- WatchGuard APproduct · 1
- WatchGuard Access Pointproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.