What is CVE-2026-13728?

CVE-2026-13728 is a medium-severity vulnerability in Watchguard Fireboxcloud, classified under Use of Hard-coded Credentials. CVSS score: 4.4/10. Published 2026-07-03.

How severe is CVE-2026-13728?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Vulnerability in Watchguard Fireboxcloud

CVE-2026-13728

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

EPSS: 0.001 (3.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory, Vendor Advisory)
5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory)

Frequently asked questions

What is CVE-2026-13728?: CVE-2026-13728 is a medium-severity vulnerability in Watchguard Fireboxcloud, classified under Use of Hard-coded Credentials. CVSS score: 4.4/10. Published 2026-07-03.
How severe is CVE-2026-13728?: Medium severity. CVSS v3 base score is 4.4 out of 10.