---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in WatchGuard Fireware OS could allow unauthenticated local network attackers to execute arbitrary code.

Executive Summary:
A critical out-of-bounds write vulnerability in WatchGuard Fireware OS enables unauthenticated local network attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-8247

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an out-of-bounds write flaw in the Fireware OS, which can be triggered by an unauthenticated attacker located on the same local network segment. This allows for the execution of arbitrary code, potentially leading to a full system takeover.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a significant risk to network security, as it allows attackers to bypass perimeter defenses and gain control over critical infrastructure devices. Compromise of the firewall could lead to total network exposure, data breaches, and the disruption of business-critical communications.

Remediation Plan

Immediate Action: Update all WatchGuard Fireware OS devices to the latest patched version provided by the vendor immediately.

Proactive Monitoring: Monitor network traffic for anomalous behavior or unauthorized attempts to access management interfaces from local network segments.

Compensating Controls: Restrict local network access to management interfaces and ensure that all internal network segments are isolated to prevent unauthorized local proximity to the firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute code makes this a high-priority remediation task. Organizations must verify their firmware versions and apply patches immediately to prevent unauthorized access to their network security appliances.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Dimension
AFFECTED_VERSIONS: 2.0 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
CREDITS: Yukusawa18 (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78614","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
WatchGuard Dimension is vulnerable to an authenticated SQL injection in the audit report feature, allowing an attacker with report administration permissions to achieve arbitrary command execution.

Executive Summary:
WatchGuard Dimension contains an authenticated SQL injection vulnerability that allows an attacker with administrative privileges to execute arbitrary commands on the affected system.

Vulnerability Details

CVE-ID: CVE-2026-78614

Affected Software: WatchGuard Dimension

Affected Versions: 2.0 up to (excluding) 2.3.1

Vulnerability: This vulnerability is a SQL injection flaw located in the audit report feature. It requires the attacker to hold report administration permissions to trigger the injection, which ultimately facilitates arbitrary command execution under the context of the Dimension WebUI process user.

Business Impact

The ability to execute arbitrary commands on a network security management appliance presents a severe risk to the entire security infrastructure. An attacker could leverage this access to compromise sensitive log data, escalate privileges, or pivot deeper into the internal network. With a CVSS score of 8.6, this high severity vulnerability necessitates immediate attention to prevent full system compromise.

Remediation Plan

Immediate Action: Upgrade WatchGuard Dimension to version 2.3.1 or later to apply the vendor-supplied security patch.

Proactive Monitoring: Review system logs for anomalous activity related to the audit report module and monitor for unexpected process execution originating from the web interface.

Compensating Controls: Restrict access to the Dimension WebUI to trusted administrative internal networks and verify that the principle of least privilege is applied to all user accounts with report administration rights.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the attack requires authenticated access, the impact of arbitrary command execution makes this a high priority for remediation in any environment utilizing WatchGuard Dimension.

Analyst Recommendation

Given the potential for remote command execution, organizations must prioritize updating their WatchGuard Dimension instances to version 2.3.1 immediately. Ensure that administrative access is strictly controlled and audited to mitigate the risk of an attacker leveraging compromised credentials to exploit this flaw. Failure to patch allows for significant risk of lateral movement and persistent access within the management environment.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Dimension
AFFECTED_VERSIONS: 2.0 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
CREDITS: Yukusawa18 (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78613","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
WatchGuard Dimension is vulnerable to an authenticated SQL injection in the log viewer, allowing an attacker with administrative permissions to execute arbitrary commands as the WebUI process user.

Executive Summary:
An authenticated SQL injection vulnerability in WatchGuard Dimension allows attackers with administrative privileges to achieve remote code execution, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-78613

Affected Software: WatchGuard Dimension

Affected Versions: 2.0 up to (excluding) 2.3.1

Vulnerability: The flaw is a SQL injection (CWE-89) triggered within the log viewer feature. It requires an attacker to possess report administration permissions to submit malicious requests that lead to arbitrary command execution.

Business Impact

Successful exploitation allows an attacker to execute commands with the privileges of the Dimension WebUI process, potentially leading to full system compromise. Given the CVSS score of 8.6, this vulnerability represents a high risk: it could allow unauthorized access to sensitive log data or provide a foothold for further lateral movement within the network.

Remediation Plan

Immediate Action: Update WatchGuard Dimension to version 2.3.1 or later to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review system logs for unusual queries directed at the log viewer feature and monitor for unexpected process execution originating from the WebUI user account.

Compensating Controls: Restrict access to the administrative console to trusted internal IP addresses and employ a Web Application Firewall to filter malicious SQL syntax from incoming web requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires prior authentication, the high severity of command execution makes this a priority for remediation.

Analyst Recommendation

This vulnerability presents a significant risk due to the potential for remote code execution. Administrators should prioritize upgrading to version 2.3.1 immediately to eliminate the injection vector and secure the administrative interface against unauthorized command execution.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Dimension
AFFECTED_VERSIONS: WatchGuard Dimension: 2.0 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
CREDITS: Yukusawa18 (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78612","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature that allows users with report administration permissions to achieve arbitrary command execution.

Executive Summary:
WatchGuard Dimension is vulnerable to an authenticated SQL injection flaw that enables remote command execution, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-78612

Affected Software: WatchGuard Dimension

Affected Versions: WatchGuard Dimension: 2.0 up to (excluding) 2.3.1

Vulnerability: The vulnerability exists within the scheduled report feature, where improper handling of input allows an authenticated user with report administration privileges to perform SQL injection. This flaw can be leveraged to execute arbitrary commands as the Dimension WebUI process user.

Business Impact

Successful exploitation of this vulnerability allows an attacker with existing administrative access to escalate their control to the underlying operating system. This could lead to a full compromise of the Dimension server, resulting in unauthorized data access, potential lateral movement within the network, and significant disruption to security monitoring operations. The CVSS score of 8.6 reflects the high severity of achieving command execution within a security management appliance.

Remediation Plan

Immediate Action: Update WatchGuard Dimension to version 2.3.1 or later to resolve the underlying vulnerability.

Proactive Monitoring: Review system and application logs for anomalous database queries or unexpected process execution patterns originating from the WebUI process user.

Compensating Controls: Restrict administrative access to the Dimension WebUI to trusted internal management subnets and enforce strict least-privilege policies for all user accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the ability to transition from a restricted management role to arbitrary command execution makes this a high-priority security concern.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize upgrading their WatchGuard Dimension instances to version 2.3.1 immediately. Until the patch is applied, ensure that administrative access is restricted to verified personnel to minimize the likelihood of exploitation.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Dimension
AFFECTED_VERSIONS: WatchGuard Dimension 2.0 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
CREDITS: Yukusawa18 (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78610","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
WatchGuard Dimension contains a cross-site request forgery vulnerability in the Web UI, allowing an attacker to change an administrator passphrase via a crafted link.

Executive Summary:
A high-severity cross-site request forgery vulnerability in WatchGuard Dimension allows an attacker to seize administrative control by forcing a passphrase reset.

Vulnerability Details

CVE-ID: CVE-2026-78610

Affected Software: WatchGuard Dimension

Affected Versions: WatchGuard Dimension 2.0 up to (excluding) 2.3.1

Vulnerability: The application lacks CSRF protection on the administrator passphrase change action, which permits an attacker to perform unauthorized administrative modifications. This vulnerability requires an authenticated global administrator to be tricked into visiting a malicious site or link.

Business Impact

This vulnerability poses a significant risk to organizational security, as it allows unauthorized actors to reset the credentials of global administrators. A successful exploit grants the attacker full administrative access to the Dimension instance, leading to potential data compromise, configuration tampering, and total loss of system integrity. With a CVSS score of 8.4, this issue is categorized as High severity and requires immediate remediation.

Remediation Plan

Immediate Action: Update WatchGuard Dimension to version 2.3.1 or later as specified by the vendor.

Proactive Monitoring: Review administrative access logs for unusual login activity or passphrase modification events that do not correlate with known administrative actions.

Compensating Controls: Implement strict browser security policies and educate administrative staff on the risks of clicking untrusted links while logged into sensitive management interfaces. A Web Application Firewall (WAF) can also be configured to block suspicious cross-site requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the reliance on user interaction, which is a common vector for administrative takeover attacks.

Analyst Recommendation

Given the potential for complete administrative account compromise, this vulnerability presents an elevated risk to the security posture of the affected systems. Administrators must prioritize the application of the vendor-provided patch to version 2.3.1 to eliminate the underlying flaw. Until the update is deployed, ensure that administrative sessions are isolated and that staff exercise caution regarding external links while authenticated to the management console.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to (excluding) 2026.2.2, 12.0 up to (excluding) 12.12.2, 12.0 up to (excluding) 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: Discovered Internally by WatchGuard AI Security Research (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78011","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
An integer underflow in WatchGuard Fireware OS allows remote unauthenticated attackers to trigger a Denial of Service condition in VPN processing via crafted network traffic.

Executive Summary:
A critical integer underflow vulnerability in WatchGuard Fireware OS allows remote, unauthenticated attackers to crash VPN services, leading to significant network availability risks.

Vulnerability Details

CVE-ID: CVE-2026-78011

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to (excluding) 2026.2.2, 12.0 up to (excluding) 12.12.2, 12.0 up to (excluding) 12.5.20

Vulnerability: This is an integer underflow flaw (CWE-191) residing in the iked process. It allows an unauthenticated remote attacker to disrupt VPN operations by sending specially crafted network packets to the affected device.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting its high potential for service disruption. Successful exploitation results in a Denial of Service condition, which can disable secure remote access for employees and branch offices, causing immediate operational downtime and potential loss of productivity.

Remediation Plan

Immediate Action: Update Fireware OS to version 2026.2.2, 12.12.2, or 12.5.20 as applicable to your specific deployment.

Proactive Monitoring: Monitor VPN gateway logs for repeated connection failures or unusual traffic spikes targeting the iked process that may precede a service crash.

Compensating Controls: Restrict inbound access to VPN management and service ports to known, trusted IP addresses using access control lists to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its reliance on unauthenticated network traffic to trigger a crash in a critical security component.

Analyst Recommendation

Given the high CVSS severity and the critical role of VPN gateways in infrastructure, this vulnerability presents a significant availability risk. Security teams should prioritize patching affected Fireware OS devices during the next maintenance window to prevent potential service outages caused by malicious actors.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: Discovered Internally by WatchGuard AI Security Research (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78010","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the WatchGuard Fireware OS iked process allows remote unauthenticated attackers to cause a Denial of Service condition in VPN processing.

Executive Summary:
A high-severity buffer overflow vulnerability in WatchGuard Fireware OS permits unauthenticated remote attackers to crash VPN services, leading to significant network disruption.

Vulnerability Details

CVE-ID: CVE-2026-78010

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20

Vulnerability: This is a stack-based buffer overflow (CWE-121) located in the iked process of the VPN subsystem. The flaw is remotely exploitable by an unauthenticated attacker who can send specially crafted network packets to trigger a service crash.

Business Impact

Successful exploitation results in a Denial of Service for critical VPN infrastructure, which can halt remote access for employees and disrupt site-to-site connectivity. Given the CVSS score of 8.7, this vulnerability represents a high risk to business continuity, as it allows an external actor to disable security appliances without requiring valid credentials.

Remediation Plan

Immediate Action: Update affected Fireware OS appliances to the patched versions: 2026.2.2, 12.12.2, or 12.5.20.

Proactive Monitoring: Monitor firewall system logs for irregular iked process crashes or unexpected service restarts that may indicate exploitation attempts.

Compensating Controls: Restrict access to the VPN management interface and IKE ports to known, trusted IP addresses using upstream access control lists where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, specifically as a memory corruption issue in a network-facing service, makes it a prime candidate for future exploit development.

Analyst Recommendation

Organizations utilizing WatchGuard Fireware OS should prioritize this update as part of their immediate maintenance cycle. Because the vulnerability allows for unauthenticated disruption of network services, applying the vendor-provided patches is the only definitive way to eliminate the risk of service interruption by remote actors.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: Discovered Internally by WatchGuard AI Security Research (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78009","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A remote, unauthenticated out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process enables attackers to trigger a Denial of Service condition in VPN processing.

Executive Summary:
A critical out-of-bounds read vulnerability in WatchGuard Fireware OS allows unauthenticated remote attackers to disrupt VPN services via a Denial of Service attack.

Vulnerability Details

CVE-ID: CVE-2026-78009

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20

Vulnerability: The vulnerability exists within the iked process, which is responsible for Internet Key Exchange (IKE) operations. An unauthenticated remote attacker can exploit this flaw by sending specially crafted network traffic to the device, leading to a crash of the VPN processing service.

Business Impact

The ability for an unauthenticated attacker to force a Denial of Service condition on VPN infrastructure presents a significant risk to organizational availability. Given the CVSS score of 8.7, this vulnerability is classified as High severity because it allows for remote disruption of secure remote access tunnels, potentially isolating remote workers or branch offices from the internal network.

Remediation Plan

Immediate Action: Update Fireware OS to version 2026.2.2, 12.12.2, or 12.5.20 as specified in the vendor security advisory.

Proactive Monitoring: Monitor firewall system logs for repeated iked service crashes or unusual spikes in malformed IKE traffic patterns.

Compensating Controls: Implement strict access control lists on the firewall external interface to limit IKE traffic to known and trusted peer IP addresses where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the unauthenticated nature of the attack vector, which allows for remote service disruption without requiring prior system access.

Analyst Recommendation

Given the potential for complete disruption of VPN connectivity, organizations must prioritize patching their WatchGuard appliances. Apply the recommended firmware updates during the next available maintenance window to ensure the stability and security of remote access infrastructure.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: Cody Sixteen (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-78008","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator to trigger a denial of service or arbitrary code execution via crafted network traffic.

Executive Summary:
A high-severity buffer overflow vulnerability in WatchGuard Fireware OS could allow an authenticated administrator to compromise system integrity or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-78008

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20

Vulnerability: This is a buffer overflow (CWE-787) flaw located in the Management Web UI. Successful exploitation requires the attacker to have already obtained administrative-level authentication to the interface.

Business Impact

The vulnerability carries a CVSS score of 8.6, reflecting the potential for complete loss of system availability and the integrity of the firewall appliance. An attacker with administrative credentials could execute arbitrary code, potentially leading to unauthorized network control, lateral movement, or complete disruption of critical security infrastructure.

Remediation Plan

Immediate Action: Upgrade all affected WatchGuard Fireware OS instances to version 2026.2.2, 12.12.2, or 12.5.20 immediately.

Proactive Monitoring: Review administrative access logs for suspicious activity or abnormal traffic patterns originating from authorized administrative accounts.

Compensating Controls: Restrict access to the Management Web UI to trusted management IP addresses only and enforce strict multi-factor authentication for all administrative sessions to minimize the risk of credential compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires administrative privileges, the potential for arbitrary code execution makes it a high priority for organizations managing perimeter security.

Analyst Recommendation

Given the critical role of Fireware OS in maintaining perimeter security, organizations should treat this vulnerability with urgency. Administrators must verify their current firmware version against the fixed releases and apply the necessary patches during the next maintenance window to prevent potential exploitation of the Management Web UI.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: McCaulay Hudson (@_McCaulay) of watchTowr (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-19317","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows remote unauthenticated attackers to trigger a denial of service in VPN processing via crafted network traffic.

Executive Summary:
A critical out-of-bounds read vulnerability in WatchGuard Fireware OS enables remote, unauthenticated attackers to disrupt VPN services through a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2026-19317

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20

Vulnerability: The flaw exists within the iked process, which manages internet key exchange for VPN tunnels. An unauthenticated remote attacker can send specifically crafted network packets to trigger an out-of-bounds read, causing the service to crash and resulting in a denial of service.

Business Impact

The ability for an unauthenticated attacker to remotely crash VPN processing poses a significant risk to organizational connectivity and remote access infrastructure. With a CVSS score of 8.7, this vulnerability is classified as high severity because it directly impacts the availability of secure communications, potentially leading to business disruption and loss of workforce productivity.

Remediation Plan

Immediate Action: Upgrade all affected WatchGuard Fireware OS installations to version 2026.2.2, 12.12.2, or 12.5.20 immediately.

Proactive Monitoring: Monitor firewall logs for anomalous iked process behavior or high volumes of malformed traffic directed at VPN endpoints.

Compensating Controls: Implement rate limiting on VPN gateway interfaces to mitigate the impact of potential flood-based exploits until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication, making it a prime candidate for automated denial of service attacks.

Analyst Recommendation

Given the remote nature of this vulnerability and the critical role of VPN gateways in network security, administrators should prioritize patching as a matter of urgency. By updating to the versions specified in the vendor solution, organizations can effectively eliminate the risk of service disruption caused by this out-of-bounds read flaw.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20
CONFIDENCE: high
MISSING: none
CREDITS: McCaulay Hudson (@_McCaulay) of watchTowr (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-19316","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to trigger a Denial of Service condition in VPN processing.

Executive Summary:
A remote, unauthenticated double-free vulnerability in WatchGuard Fireware OS permits attackers to disrupt VPN services via specially crafted network traffic, posing a high availability risk.

Vulnerability Details

CVE-ID: CVE-2026-19316

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2, 12.0 up to 12.12.2, 12.0 up to 12.5.20

Vulnerability: The vulnerability exists within the iked process, which manages Internet Key Exchange operations. An unauthenticated attacker can exploit this double-free flaw by sending malformed network packets to the VPN service, resulting in a system crash or service disruption.

Business Impact

The exploitation of this vulnerability leads to a Denial of Service condition, which can effectively disconnect remote users and branch offices from the corporate network. Given the CVSS score of 8.7, this flaw represents a significant risk to business continuity, as it allows attackers to disrupt critical infrastructure without requiring any prior authentication or user interaction.

Remediation Plan

Immediate Action: Update WatchGuard Fireware OS to version 2026.2.2, 12.12.2, or 12.5.20 as specified in the vendor security advisory.

Proactive Monitoring: Monitor VPN gateway logs for unusual traffic patterns or frequent service restarts associated with the iked process.

Compensating Controls: While a direct patch is the only permanent solution, ensure the management interface of the appliance is not exposed to the public internet to limit the attack surface.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated nature, which facilitates automated exploitation attempts against internet-facing VPN endpoints.

Analyst Recommendation

This vulnerability presents a high risk to network availability and should be addressed as a priority. Administrators must schedule maintenance windows to apply the prescribed firmware updates immediately to prevent potential service outages caused by exploitation of the iked process.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 2025.0 up to 2026.2.2 (exclusive), 12.0 up to 12.12.2 (exclusive), 12.0 up to 12.5.20 (exclusive)
CONFIDENCE: high
MISSING: none
CREDITS: McCaulay Hudson (@_McCaulay) of watchTowr (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-19314","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A remote unauthenticated integer underflow vulnerability in the WatchGuard Fireware OS iked process allows attackers to trigger a Denial of Service condition in VPN processing.

Executive Summary:
A remote, unauthenticated integer underflow vulnerability in WatchGuard Fireware OS permits attackers to disrupt VPN services, posing a high risk to network availability.

Vulnerability Details

CVE-ID: CVE-2026-19314

Affected Software: WatchGuard Fireware OS

Affected Versions: 2025.0 up to 2026.2.2 (exclusive), 12.0 up to 12.12.2 (exclusive), 12.0 up to 12.5.20 (exclusive)

Vulnerability: This vulnerability involves an integer underflow within the iked process, which is responsible for IKE daemon operations. An unauthenticated remote attacker can exploit this by sending specially crafted network traffic to the device, leading to a system crash or service disruption.

Business Impact

The exploitation of this flaw results in a Denial of Service for VPN connectivity, which can severely impact remote workforce operations and secure site to site communication. With a CVSS score of 8.7, this vulnerability is classified as high severity, reflecting the ease of exploitation and the significant operational disruption it causes to critical network infrastructure.

Remediation Plan

Immediate Action: Update Fireware OS to version 2026.2.2, 12.12.2, or 12.5.20 as applicable to your hardware deployment.

Proactive Monitoring: Monitor firewall system logs and VPN gateway health metrics for unexpected restarts or service interruptions in the iked process.

Compensating Controls: While a patch is available, organizations should restrict access to VPN management interfaces to trusted IP addresses where possible to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by unauthenticated network traffic, which requires no interaction from legitimate users.

Analyst Recommendation

Given the high CVSS score and the critical nature of VPN gateways in maintaining secure network perimeters, immediate patching is essential to prevent service outages. Administrators should prioritize these updates during the next maintenance window to ensure the continued stability and availability of their network security infrastructure.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
WatchGuard Fireware OS is susceptible to a firmware validation bypass, potentially allowing unauthorized code execution through the backup and restore functionality.

Executive Summary:
A firmware validation bypass in WatchGuard Fireware OS poses a significant risk of unauthorized system modification via the backup/restore feature.

Vulnerability Details

CVE-ID: CVE-2026-13722

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a firmware validation bypass vulnerability residing within the backup/restore function of the Fireware OS. The vulnerability allows an attacker to bypass integrity checks, likely requiring administrative or local-network access to supply a malicious backup image.

Business Impact

The ability to bypass firmware validation can lead to full system compromise, allowing an attacker to persist in the network or exfiltrate sensitive traffic data. With a CVSS score of 8.6, this vulnerability is classified as High severity and represents a critical threat to network perimeter security and internal infrastructure integrity.

Remediation Plan

Immediate Action: Monitor official WatchGuard security advisories and apply the provided firmware patch as soon as it becomes available.

Proactive Monitoring: Review system logs for unauthorized attempts to initiate backup or restore operations, particularly from non-standard administrative accounts.

Compensating Controls: Restrict administrative access to the Fireware OS management interface to trusted, internal IP addresses only, and employ network segmentation to isolate critical infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of Fireware OS in network security, the potential for this vulnerability to lead to device takeover is severe. Administrators must prioritize the application of vendor-supplied firmware updates immediately upon release to mitigate the risk of unauthorized system manipulation.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS wgagent process enables authenticated privileged users to execute arbitrary code via the Management Web UI.

Executive Summary:
A critical Out-of-bounds Write vulnerability in WatchGuard Fireware OS could allow an authenticated privileged attacker to achieve arbitrary code execution on the appliance.

Vulnerability Details

CVE-ID: CVE-2026-13384

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an Out-of-bounds Write vulnerability located in the wgagent process. An attacker requires authenticated privileged access to the Management Web UI to submit a specially crafted request that triggers the flaw.

Business Impact

The ability to execute arbitrary code with elevated privileges on a firewall appliance poses a severe risk to network security, potentially allowing full system compromise. Given the CVSS score of 8.6, this vulnerability represents a high risk of unauthorized access to sensitive network traffic and security configurations, which could lead to widespread data breaches or complete network control.

Remediation Plan

Immediate Action: Restrict access to the Management Web UI to trusted administrative IP addresses only and monitor vendor channels for the release of a security patch.

Proactive Monitoring: Audit Management Web UI access logs for anomalous, high-frequency, or malformed requests targeting the wgagent service.

Compensating Controls: Ensure that the Management Web UI is not exposed to the public internet and utilize internal network segmentation to limit the number of users who can reach the interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this vulnerability, administrators should prioritize limiting access to the affected Management Web UI immediately. Organizations must treat this as a high-priority risk and apply vendor-supplied patches as soon as they become available to prevent potential full-system compromise.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS ikestubd process allows authenticated privileged users to execute arbitrary code via crafted Management Web UI requests.

Executive Summary:
An authenticated privileged user can exploit an out-of-bounds write vulnerability in the WatchGuard Fireware OS ikestubd process to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-13383

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the ikestubd process, which handles IKE/IPsec-related tasks. It is reachable via the Management Web UI and requires the attacker to have authenticated privileged access to the system to trigger the out-of-bounds write.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a significant risk to the security of VPN and IPsec tunnels managed by the device. Exploitation could lead to the complete takeover of the appliance, exposing encrypted traffic and internal network segments to unauthorized actors.

Remediation Plan

Immediate Action: Update the Fireware OS to the latest version provided by WatchGuard to mitigate the vulnerability in the ikestubd process.

Proactive Monitoring: Inspect system logs for unusual restarts of the ikestubd process or errors related to memory management.

Compensating Controls: Limit access to the Management Web UI to authenticated administrators from a secure, hardened management network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Security teams should prioritize patching affected WatchGuard devices and ensure that administrative access is strictly controlled to mitigate the risk posed by potential privilege escalation or lateral movement within the network.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: 11.0 to 11.12.4_Update1, 12.0 to 12.12, 2025.1 to 2026.2
---END_METADATA---

Description Summary:
A use-after-free race condition in WatchGuard Fireware OS allows unauthenticated remote attackers to execute arbitrary code via the IKEv2 Mobile VPN.

Executive Summary:
A critical use-after-free vulnerability in the WatchGuard Fireware OS LDAP authentication process allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-13368

Affected Software: WatchGuard Fireware OS

Affected Versions: 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2.

Vulnerability: This is a race condition leading to a use-after-free vulnerability within the LDAP authentication module for IKEv2 VPNs. An unauthenticated remote attacker can trigger this flaw to execute code within the context of the 'iked' service.

Business Impact

The CVSS score of 9.2 highlights the critical nature of this vulnerability, as it allows for unauthenticated remote code execution on edge networking hardware. Compromise of a VPN gateway provides an attacker with a foothold into the internal network, potentially leading to widespread lateral movement and full data exfiltration.

Remediation Plan

Immediate Action: Upgrade all affected WatchGuard Fireware OS devices to the latest patched version provided by the vendor immediately.

Proactive Monitoring: Review VPN session logs for unusual connection attempts or crashes of the 'iked' process, which may indicate an exploitation attempt.

Compensating Controls: If patching is not immediately feasible, restrict access to the VPN gateway to known, trusted IP addresses and consider disabling IKEv2 if a viable alternative authentication method exists.

Exploitation Status

Public Exploit Available: N/A

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. Given the criticality of VPN gateways as an attack vector, the risk of exploitation is extremely high.

Analyst Recommendation

This vulnerability is highly critical due to the potential for remote code execution on a security appliance. It is imperative that administrators prioritize the firmware update to secure the perimeter and prevent unauthorized access to the internal network.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Dimension
AFFECTED_VERSIONS: WatchGuard Dimension: 2.0 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
CREDITS: Alessandro Vannini, IT4YOU Cybersecurity (finder)
SOURCES_JSON: [{"url":"https://psirt.watchguard.com/CVE-2026-13108","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
WatchGuard Dimension is vulnerable to a denial-of-service attack, where an unauthenticated attacker can flood the log listening service with TCP SYN packets to disrupt availability.

Executive Summary:
WatchGuard Dimension is affected by a high-severity denial-of-service vulnerability that allows unauthenticated attackers to disrupt system availability via TCP SYN flooding.

Vulnerability Details

CVE-ID: CVE-2026-13108

Affected Software: WatchGuard Dimension

Affected Versions: WatchGuard Dimension: 2.0 up to (excluding) 2.3.1

Vulnerability: This is a resource exhaustion vulnerability (CWE-400) occurring in the log listening service of WatchGuard Dimension. An unauthenticated attacker can trigger this condition by sending a high volume of TCP SYN packets, leading to a denial-of-service state.

Business Impact

Successful exploitation of this vulnerability results in a denial-of-service condition, effectively taking the log management system offline. With a CVSS score of 8.7, this flaw poses a significant risk to operational continuity, as it prevents the ingestion and monitoring of critical security logs. Such an outage could hinder incident response efforts and compromise the visibility of the network security posture.

Remediation Plan

Immediate Action: Update WatchGuard Dimension to version 2.3.1 or later to resolve the underlying resource handling flaw.

Proactive Monitoring: Monitor system logs and network traffic for unusual spikes in TCP SYN packets directed at the log listening service.

Compensating Controls: Implement rate limiting or firewall rules to restrict traffic to the log listening service to known, trusted IP addresses, which can serve as a temporary mitigation against flood-based attacks.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently straightforward to trigger, as it relies on standard network flooding techniques that require no authentication.

Analyst Recommendation

Given the high CVSS score and the potential for service disruption, organizations should prioritize the deployment of the vendor-provided patch. Updating to version 2.3.1 is the only definitive method to remediate this vulnerability and restore system resilience against SYN flood attacks.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A null pointer dereference in WatchGuard Fireware OS allows unauthenticated remote attackers to trigger a denial-of-service via crafted IKEv2 messages.

Executive Summary:
A critical denial-of-service vulnerability in WatchGuard Fireware OS allows unauthenticated remote attackers to crash network security appliances.

Vulnerability Details

CVE-ID: CVE-2026-13084

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is a null pointer dereference occurring during the processing of IKEv2 messages. It can be triggered by a remote, unauthenticated attacker who sends specially crafted packets to the appliance, causing the system to crash or become unresponsive.

Business Impact

The CVSS score of 8.7 highlights the severe risk to perimeter security. If an attacker successfully forces a crash of the firewall, the organization’s network defenses are neutralized, resulting in a total loss of visibility, security, and potential system downtime.

Remediation Plan

Immediate Action: Apply the latest firmware updates for WatchGuard Fireware OS to all affected network appliances immediately.

Proactive Monitoring: Monitor firewall health status, CPU load, and system logs for signs of sudden reboots or abnormal IKEv2 processing errors.

Compensating Controls: If immediate patching is not feasible, restrict IKEv2 traffic to known, trusted peer IP addresses at the edge to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score and the nature of this vulnerability as a remote, unauthenticated denial-of-service attack make it a high priority for remediation. Network administrators must treat this as an urgent task to maintain the stability and security of their network perimeter.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows authenticated attackers to write arbitrary files to the Firebox filesystem.

Executive Summary:
An authenticated path traversal vulnerability in the WatchGuard Fireware OS Management Web UI permits attackers to write arbitrary files to the appliance filesystem, threatening device integrity.

Vulnerability Details

CVE-ID: CVE-2026-13054

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This path traversal flaw exists within the Management Web UI, allowing an attacker who has already achieved authenticated, privileged access to write files outside of intended directories on the appliance.

Business Impact

This vulnerability carries a CVSS score of 8.6, reflecting the high risk to the core security appliance governing network traffic. An attacker could leverage this write capability to modify system binaries or configuration files, effectively bypassing security policies, disabling firewall features, or creating persistent backdoors within the network perimeter.

Remediation Plan

Immediate Action: Apply the latest firmware updates for Fireware OS immediately to resolve the directory traversal flaw.

Proactive Monitoring: Monitor management interface logs for unauthorized file write attempts or anomalous access patterns from administrative accounts.

Compensating Controls: Limit access to the Management Web UI to dedicated administrative workstations or management networks to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security appliances are high-value targets; therefore, any vulnerability affecting the management interface must be addressed with extreme urgency. Organizations should verify that their Firebox firmware is up to date and that administrative access to the Web UI is strictly controlled and audited.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS CLI allows authenticated privileged users to execute arbitrary code via specially crafted CLI commands.

Executive Summary:
A critical out-of-bounds write vulnerability in the WatchGuard Fireware OS CLI could allow an authenticated privileged user to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-13053

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the command-line interface (CLI) of the operating system. It allows an authenticated user with sufficient privileges to trigger an out-of-bounds write condition by inputting a specially crafted command, potentially resulting in remote code execution.

Business Impact

A CVSS score of 8.6 underscores the significant danger posed by this vulnerability. If exploited, an attacker could gain persistent, high-level control over the firewall, effectively bypassing all perimeter defenses and jeopardizing the integrity and confidentiality of the entire internal network.

Remediation Plan

Immediate Action: Apply all applicable security patches and firmware updates released by WatchGuard to address the CLI vulnerability.

Proactive Monitoring: Monitor CLI session logs for irregular command patterns or unexpected system crashes that may indicate exploitation attempts.

Compensating Controls: Implement strict role-based access control (RBAC) to ensure only essential personnel have CLI access to the appliances.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must treat this vulnerability with high urgency. Patching is the only definitive way to resolve the underlying memory corruption flaw; therefore, administrators should verify their current firmware version against the vendor's security advisory and apply the necessary updates immediately.

---METADATA---
VENDOR: WatchGuard
PRODUCT: Fireware OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS networkd process allows authenticated privileged users to execute arbitrary code via crafted Management Web UI requests.

Executive Summary:
An authenticated privileged user can exploit an out-of-bounds write vulnerability in WatchGuard Fireware OS to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-13050

Affected Software: WatchGuard Fireware OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the networkd process of Fireware OS and is triggered by sending specially crafted requests to the Management Web UI. Successful exploitation requires the attacker to possess authenticated privileged access to the appliance.

Business Impact

The ability for a privileged user to execute arbitrary code on a network security appliance poses a severe risk to organizational infrastructure. With a CVSS score of 8.6, this flaw could lead to a total compromise of the firewall, enabling lateral movement, data interception, or the subversion of critical security policies.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by WatchGuard as soon as they become available.

Proactive Monitoring: Review administrative access logs for anomalous activity or unusual commands originating from privileged sessions.

Compensating Controls: Restrict access to the Management Web UI to trusted management subnets only to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical nature of the affected component, organizations should prioritize patching this vulnerability immediately upon vendor release. Restricting administrative access remains a vital secondary measure to prevent unauthorized users from reaching the vulnerable management interfaces.