WatchGuard vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited WatchGuard flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-14733 WatchGuard Firebox Out of Bounds WriteExploited since Dec 19, 2025 · ransomware · CVSS 9.3
• CVE-2025-9242 WatchGuard Firebox Out-of-Bounds WriteExploited since Nov 12, 2025 · CVSS 9.3
• CVE-2022-23176 WatchGuard Firebox and XTM Privilege EscalationExploited since Apr 11, 2022 · CVSS 8.8
• CVE-2022-26318 WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionExploited since Mar 25, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-93866 An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker Critical 9.2 · Oct 27, 2026
• CVE-2026-93865 A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged systCritical 9.2 · Oct 27, 2026
• CVE-2026-93864 A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to oveHigh 7.1 · Oct 27, 2026
• CVE-2026-93862 An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster High 7.2 · Oct 27, 2026
• CVE-2026-93857 A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a speciallCritical 9.2 · Oct 27, 2026
• CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management High 8.7 · Oct 27, 2026
• CVE-2026-90465 A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised clustCritical 9.4 · Oct 27, 2026
• CVE-2026-90464 An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least reaHigh 7.2 · Oct 27, 2026
• CVE-2026-90442 A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface toHigh 8.6 · Oct 27, 2026
• CVE-2026-112710 A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configuCritical 9.2 · Oct 27, 2026
• CVE-2026-112709 A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured ActCritical 9.2 · Oct 27, 2026
• CVE-2026-111107 A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the mHigh 8.7 · Oct 27, 2026
• CVE-2026-103594 A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypteCritical 9.5 · Oct 27, 2026
• CVE-2026-103593 A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to thHigh 7.1 · Oct 27, 2026
• CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modifyHigh 7.3 · Oct 22, 2026
• CVE-2026-13043 A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated aCritical 9.3 · Oct 1, 2026
• CVE-2026-86134 A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management High 8.7 · Sep 30, 2026
• CVE-2026-90441 A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includingHigh 7.1 · Sep 29, 2026
• CVE-2026-86136 A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includingHigh 7.1 · Sep 29, 2026
• CVE-2026-86133 An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to craHigh 8.2 · Sep 29, 2026
• CVE-2026-86132 An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending aHigh 8.2 · Sep 29, 2026
• CVE-2026-86131 A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server toCritical 9.2 · Sep 29, 2026
• CVE-2026-86128 A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of serviHigh 8.2 · Sep 29, 2026
• CVE-2026-86104 An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of serHigh 8.7 · Sep 29, 2026
• CVE-2026-86101 An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access PHigh 7.2 · Sep 29, 2026