Watchguard Fireware
75 CVEs affecting Watchguard Fireware. Latest disclosed: 2026-09-30. Critical: 6, High: 37.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86131 | Critical | 9.8 | 2026-09-30 | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server t… |
CVE-2025-14733 | Critical | 9.8 | 2025-12-19 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2025-9242 | Critical | 9.8 | 2025-09-17 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2022-31789 | Critical | 9.8 | 2022-09-06 | An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arb… |
CVE-2022-26318 | Critical | 9.8 | 2022-03-04 | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7… |
CVE-2022-25361 | Critical | 9.1 | 2022-06-07 | WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This… |
CVE-2026-8247 | High | 8.8 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary cod… |
CVE-2022-25360 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnera… |
CVE-2022-25293 | High | 8.8 | 2022-02-24 | A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by… |
CVE-2022-25292 | High | 8.8 | 2022-02-24 | A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by… |
CVE-2022-25291 | High | 8.8 | 2022-02-24 | An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially ex… |
CVE-2022-23176 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via expos… |
CVE-2026-90441 | High | 8.1 | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-86136 | High | 8.1 | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-13368 | High | 8.1 | 2026-07-03 | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote… |
CVE-2026-13079 | High | 7.8 | 2026-07-03 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT… |
CVE-2022-31791 | High | 7.8 | 2022-09-06 | WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root pe… |
CVE-2026-86134 | High | 7.5 | 2026-09-30 | A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management… |
CVE-2026-86133 | High | 7.5 | 2026-09-30 | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to cr… |
CVE-2026-86132 | High | 7.5 | 2026-09-30 | An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending… |