Fireware Os (Watchguard) - vulnerabilities (CVEs)

90 CVEs, 32 in the last 30 days, 20 known versions, newest CVE from 2026-10-27. Vendor: Watchguard.

CVEs of Fireware Os

CVE-2026-90465 - CVSS 9.4 (critical), 2026-10-27: A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised…
CVE-2026-93434 - CVSS 8.7 (high), 2026-10-27: An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the…
CVE-2026-112709 - CVSS 9.2 (critical), 2026-10-27: A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured…
CVE-2026-93862 - CVSS 7.2 (high), 2026-10-27: An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised…
CVE-2026-103593 - CVSS 9.1 (critical), 2026-10-27: A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to…
CVE-2026-113881 - CVSS 6.1 (medium), 2026-10-27: A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial…
CVE-2026-90464 - CVSS 7.2 (high), 2026-10-27: An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least…
CVE-2026-112710 - CVSS 9.2 (critical), 2026-10-27: A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the…
CVE-2026-90442 - CVSS 8.6 (high), 2026-10-27: A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface…
CVE-2026-93864 - CVSS 7.1 (high), 2026-10-27: A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to…
CVE-2026-103594 - CVSS 9.5 (critical), 2026-10-27: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle…
CVE-2026-82332 - CVSS 5.7 (medium), 2026-10-27: An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on…
CVE-2026-93866 - CVSS 9.2 (critical), 2026-10-27: An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated…
CVE-2026-111107 - CVSS 8.7 (high), 2026-10-27: A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the…
CVE-2026-93857 - CVSS 9.2 (critical), 2026-10-27: A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a…
CVE-2026-93865 - CVSS 9.2 (critical), 2026-10-27: A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged…
CVE-2026-104381 - CVSS 6 (medium), 2026-10-27: A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster…
CVE-2026-86134 - CVSS 8.7 (high), 2026-09-30: A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the…
CVE-2026-86104 - CVSS 8.7 (high), 2026-09-29: An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of…
CVE-2026-86132 - CVSS 8.2 (high), 2026-09-29: An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending…
CVE-2026-90441 - CVSS 8.1 (high), 2026-09-29: A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user…
CVE-2026-13046 - CVSS 7.5 (high), 2026-09-29: A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already…
CVE-2026-18145 - CVSS 8.6 (high), 2026-09-29: A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator…
CVE-2026-86131 - CVSS 9.8 (critical), 2026-09-29: A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server…
CVE-2026-86136 - CVSS 8.1 (high), 2026-09-29: A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user…
CVE-2026-18105 - CVSS 7.1 (high), 2026-09-29: An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of…
CVE-2026-86101 - CVSS 7.2 (high), 2026-09-29: An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access…
CVE-2026-86128 - CVSS 8.2 (high), 2026-09-29: A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of…
CVE-2026-86133 - CVSS 8.2 (high), 2026-09-29: An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to…
CVE-2026-13224 - CVSS 8.2 (high), 2026-09-29: A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local…
CVE-2026-81433 - CVSS 8.7 (high), 2026-09-29: A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent…
CVE-2026-86105 - CVSS 7.1 (high), 2026-09-29: An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access…
CVE-2026-19317 - CVSS 8.7 (high), 2026-08-27: An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS)…
CVE-2026-78011 - CVSS 8.7 (high), 2026-08-27: An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS)…
CVE-2026-19315 - CVSS 9.3 (critical), 2026-08-27: A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending…
CVE-2026-19314 - CVSS 8.7 (high), 2026-08-27: An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS)…
CVE-2026-78009 - CVSS 8.7 (high), 2026-08-27: An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS)…
CVE-2026-19313 - CVSS 9.3 (critical), 2026-08-27: An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending…
CVE-2026-19316 - CVSS 8.7 (high), 2026-08-27: A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition…
CVE-2026-78008 - CVSS 8.6 (high), 2026-08-27: A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of…
CVE-2026-13086 - CVSS 9.3 (critical), 2026-08-27: A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows…
CVE-2026-19318 - CVSS 9.3 (critical), 2026-08-27: A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by…
CVE-2026-78010 - CVSS 8.7 (high), 2026-08-27: A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service…
CVE-2026-81851 - CVSS 6.9 (medium), 2026-08-27: A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a…
CVE-2026-13053 - CVSS 8.6 (high), 2026-07-02: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially…
CVE-2026-13050 - CVSS 8.6 (high), 2026-07-02: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a…
CVE-2026-13054 - CVSS 8.6 (high), 2026-07-02: A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the…
CVE-2026-8247 - CVSS 8.8 (high), 2026-07-02: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary…
CVE-2026-13728 - CVSS 5.9 (medium), 2026-07-02: In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal…
CVE-2026-13084 - CVSS 8.7 (high), 2026-07-02: A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition…
CVE-2026-13368 - CVSS 9.2 (critical), 2026-07-02: WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote…
CVE-2026-13722 - CVSS 8.6 (high), 2026-07-02: WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can…
CVE-2026-13384 - CVSS 8.6 (high), 2026-07-02: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a…
CVE-2026-13383 - CVSS 8.6 (high), 2026-07-02: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a…
CVE-2026-13377 - CVSS 4.8 (medium), 2026-07-02: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows…
CVE-2026-13376 - CVSS 4.8 (medium), 2026-07-02: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows…
CVE-2026-13375 - CVSS 4.8 (medium), 2026-07-02: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology…
CVE-2026-13374 - CVSS 4.8 (medium), 2026-07-02: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology…
CVE-2026-13373 - CVSS 4.8 (medium), 2026-07-02: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology…
CVE-2026-13371 - CVSS 6.9 (medium), 2026-07-02: An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the…
CVE-2026-3987 - CVSS 8.6 (high), 2026-04-01: A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute…
CVE-2026-4315 - CVSS 7.1 (high), 2026-03-30: A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS)…
CVE-2026-4266 - CVSS 8.4 (high), 2026-03-30: An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another…
CVE-2026-3344 - CVSS 6.9 (medium), 2026-03-03: A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a…
CVE-2026-3343 - CVSS 6.1 (medium), 2026-03-03: A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated…
CVE-2026-3342 - CVSS 8.6 (high), 2026-03-03: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root…
CVE-2026-1498 - CVSS 7 (high), 2026-01-30: An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP…
CVE-2025-14733 - CVSS 9.8 (critical), 2025-12-19: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This…
CVE-2025-6946 - CVSS 4.8 (medium), 2025-12-04: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An…
CVE-2025-1547 - CVSS 7.5 (high), 2025-12-04: A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to…
CVE-2025-1545 - CVSS 8.2 (high), 2025-12-04: An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox…
CVE-2025-13940 - CVSS 6.7 (medium), 2025-12-04: An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity…
CVE-2025-13939 - CVSS 6.1 (medium), 2025-12-04: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless…
CVE-2025-12196 - CVSS 8.6 (high), 2025-12-04: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially…
CVE-2025-13938 - CVSS 6.1 (medium), 2025-12-04: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology…
CVE-2025-13937 - CVSS 6.1 (medium), 2025-12-04: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology…
CVE-2025-13936 - CVSS 6.1 (medium), 2025-12-04: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology…
CVE-2025-11838 - CVSS 8.7 (high), 2025-12-04: A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile…
CVE-2025-12195 - CVSS 8.6 (high), 2025-12-04: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially…
CVE-2025-12026 - CVSS 8.6 (high), 2025-12-04: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary…
CVE-2025-4106 - CVSS 8.9 (high), 2025-10-24: An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading…
CVE-2025-9242 - CVSS 9.8 (critical), 2025-09-17: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This…
CVE-2025-6999 - CVSS 6.9 (medium), 2025-09-15: An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter…
CVE-2025-6947 - CVSS 4.8 (medium), 2025-09-15: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An…
CVE-2025-4804 - CVSS 4.8 (medium), 2025-05-16: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the…
CVE-2025-4805 - CVSS 4.8 (medium), 2025-05-16: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An…
CVE-2025-1239 - CVSS 4.8 (medium), 2025-02-14: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An…
CVE-2025-1071 - CVSS 4.8 (medium), 2025-02-14: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An…
CVE-2025-0178 - CVSS 6.1 (medium), 2025-02-14: An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in…
CVE-2022-31749 - CVSS 6.5 (medium), 2025-01-28: An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an…
CVE-2024-5974 - CVSS 8.6 (high), 2024-07-09: A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with…