Loading story…
WatchGuard published security advisories for multiple Fireware OS vulnerabilities affecting Firebox appliances and related deployments, and the Canadian Centre for Cyber Security urged organizations to apply updates. The issues include an out-of-bounds write that could allow a privileged, authenticated administrator to achieve root-level arbitrary code execution via an exposed management interface (CVE-2026-3342), and a filesystem integrity check bypass that could allow an attacker to maintain limited persistence by using a maliciously crafted firmware update package (CVE-2026-3344). A separate advisory also notes a reflected XSS issue in the Fireware Web UI (CVE-2026-3343).
Affected versions span multiple Fireware OS branches, including 12.0–12.11.7, 12.5.9–12.5.16 (T15/T35 models), and 2025.1–2026.1.1, with additional impact noted for 11.x in the out-of-bounds write advisory (11.x is end-of-life). WatchGuard’s fixes are available in 12.11.8, 12.5.17, and 2026.1.2 (depending on branch/model), and no workaround was listed for the integrity-check bypass or out-of-bounds write issues; organizations should prioritize patching and ensure management interfaces are not unnecessarily exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
WatchGuard published PSIRT advisory WGSA-2026-00022 for a firmware image validation bypass vulnerability affecting Firebox devices running Fireware OS. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00024 for a null pointer dereference vulnerability affecting the Firebox iked component. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00019 for a stored cross-site scripting vulnerability affecting SIP Proxy configuration on Firebox devices. This is a new vendor disclosure separate from the other March, April, and July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00020 for an out-of-bounds write vulnerability affecting the Firebox ikestubd component. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00029 for an out-of-bounds write vulnerability affecting the Firebox networkd component. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00014 for a denial-of-service vulnerability caused by unsafe deserialization in the Firebox Management Web UI on Firebox devices. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00017 for a stored cross-site scripting vulnerability affecting the Autotask Technology Integration configuration on Firebox devices. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00026 for an out-of-bounds write vulnerability affecting the Firebox admd component on Firebox devices. This is a new vendor disclosure separate from the March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00021 for an out-of-bounds write vulnerability affecting the Firebox wgagent component. This is a new vendor disclosure separate from the March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00018 for a stored cross-site scripting vulnerability affecting the spamBlocker module on Firebox devices. This is a new vendor disclosure separate from the earlier March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00023 for a race condition and use-after-free vulnerability affecting Firebox Mobile VPN with IKEv2 LDAP authentication. This is a new vendor disclosure separate from the March, April, and other July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00016 for a stored cross-site scripting vulnerability affecting the ConnectWise Technology Integration configuration on Firebox devices. This is a new vendor disclosure separate from the earlier March, April, and July 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00030 for an authenticated out-of-bounds write vulnerability in the Firebox Management CLI command handler on Firebox devices. This is a new vendor disclosure separate from the March and April 2026 Firebox advisories already in the timeline.
WatchGuard published PSIRT advisory WGSA-2026-00009 for an arbitrary file write vulnerability via path traversal in the Fireware Web UI on Firebox devices. The advisory represents a new vendor disclosure distinct from the earlier March 2026 Firebox advisories.
WatchGuard published PSIRT advisory WGSA-2026-00007 for an insecure deserialization vulnerability affecting the Fireware Access Portal on Firebox devices. The advisory constitutes a new vendor disclosure separate from the earlier March advisories and the same-day CSRF advisory.
WatchGuard published PSIRT advisory WGSA-2026-00006 for a Cross-Site Request Forgery vulnerability affecting the Fireware Web UI on Firebox devices. The advisory represents a new vendor disclosure and likely includes affected versions and remediation guidance separate from the earlier March advisories.
The Canadian Centre for Cyber Security published advisory AV26-189 highlighting WatchGuard's disclosures and urging administrators to review the advisories and apply updates. Its notice summarized three issues affecting Firebox devices, including an out-of-bounds write flaw, a reflected XSS issue in the Fireware Web UI, and a system integrity check bypass.
WatchGuard published security advisories for multiple vulnerabilities affecting Firebox devices running Fireware OS, including an out-of-bounds write flaw and a system integrity check bypass. The advisories indicated affected versions prior to 11.12.4_Update1, 12.11.8, 2026.1.2, and 12.5.17, implying updates were available to remediate the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
25 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourcecyber.gc.ca
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard disclosed two high-severity vulnerabilities in **Fireware OS** affecting Firebox appliances, including a path traversal flaw in the **Web UI** tracked as `CVE-2026-3987` and an insecure deserialization issue in the **Access Portal** tracked as `CVE-2026-4266`. The Web UI bug can let a privileged, authenticated remote attacker perform an arbitrary file write and potentially execute code in the context of an elevated system process. The Access Portal flaw can lead to arbitrary code execution as the `portald` user through insecure deserialization. The issues affect multiple Fireware OS release lines, with `CVE-2026-3987` impacting versions `12.6.1` through `12.11.8` and `2025.1` through `2026.1.2`, while `CVE-2026-4266` affects versions `12.1` through `12.11.8` and `2025.1` through `2026.1.2`. WatchGuard said the deserialization bug is not a standalone remote exploit and requires prior write access to the local filesystem, making it more relevant for post-compromise chaining. The vulnerabilities are mapped to `CWE-22` and `CWE-502`, respectively, and WatchGuard published vendor guidance including advisory `WGSA-2026-00009`; Firebox models without Access Portal support, such as the **T-15** and **T-35**, are not affected by the Access Portal issue.
Jul 3, 2026
A critical out-of-bounds write vulnerability, tracked as CVE-2025-9242, has been discovered in WatchGuard Fireware OS, affecting versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1. This flaw allows remote, unauthenticated attackers to execute arbitrary code on vulnerable Firebox firewall devices by exploiting a missing length check during the IKE handshake process. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation, and has mandated that Federal Civilian Executive Branch (FCEB) agencies apply patches by December 3, 2025. As of mid-November, over 54,000 Firebox devices remain exposed globally, with the highest concentrations in the U.S., Italy, the U.K., Germany, and Canada. WatchGuard released patches for the vulnerability on September 17, 2025, but only confirmed active exploitation in late October. CISA has emphasized the significant risk posed by this flaw, urging all organizations—not just federal agencies—to prioritize patching due to the attractiveness of firewall devices as targets for threat actors. The vulnerability's exploitation path allows attackers to bypass authentication, as the vulnerable code is executed before certificate validation. Organizations unable to apply mitigations are advised to discontinue use of affected products to prevent compromise.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-9242, has been discovered in WatchGuard's Fireware OS, affecting a wide range of Firebox network security appliances. This flaw is an out-of-bounds write in the 'iked' process, which is responsible for handling IKEv2 VPN negotiations. The vulnerability allows remote attackers to execute arbitrary code on affected devices without authentication, posing a severe risk to organizations relying on these appliances for network security. The issue specifically impacts devices configured with mobile user VPNs or branch office VPNs using IKEv2 with dynamic gateway peers. Security researchers have demonstrated that attackers can exploit this bug by sending specially crafted IKEv2 packets during the IKE_SA_AUTH phase, triggering a buffer overflow in the ike2_ProcessPayload_CERT function. Once exploited, attackers can gain control of the instruction pointer, establish Python interactive shells over TCP, and escalate to a full Linux shell by remounting filesystems and deploying BusyBox binaries. The vulnerability has been assigned a CVSS score of 9.3, underscoring its critical nature. According to scans by The Shadowserver Foundation, nearly 76,000 Firebox appliances remain exposed and vulnerable on the public internet, with the highest concentrations in the United States, Germany, Italy, the United Kingdom, Canada, and France. Affected Fireware OS versions include 11.10.2 through 11.12.4_Update1, the entire 12.0 series up to 12.11.3, and the 2025.1 release, impacting both older and newer Firebox models. WatchGuard has released patches in versions 12.3.1_Update3, 12.5.13, 12.11.4, and 2025.1.1 to address the vulnerability. Devices running version 11.x are no longer supported and will not receive security updates, prompting the vendor to recommend upgrading to a supported version. For appliances configured only with Branch Office VPNs to static gateway peers, WatchGuard has provided documentation for securing connections as a temporary workaround. The vulnerability transforms trusted security appliances into potential entry points for attackers, threatening the integrity of network defenses. Organizations are urged to assess their Firebox deployments, prioritize patching, and review VPN configurations to mitigate the risk. The widespread exposure of vulnerable devices highlights the urgency of remediation efforts. WatchGuard's disclosure and the subsequent public scanning have brought significant attention to the issue, emphasizing the importance of timely patch management in network security infrastructure. Failure to address this vulnerability could result in unauthorized access, lateral movement, and compromise of sensitive internal networks. The incident serves as a stark reminder of the risks posed by critical flaws in security appliances and the need for continuous monitoring and rapid response.
Jun 29, 2026