Loading story…
CISA has confirmed ransomware groups are exploiting CVE-2025-14733, a critical unauthenticated remote-code-execution flaw in WatchGuard Firebox firewalls. The out-of-bounds write vulnerability affects multiple Fireware OS 11.x, 12.x, and 2025.1 releases, particularly devices using vulnerable IKEv2 VPN configurations; WatchGuard has issued patches, confirmed active exploitation, and published indicators of compromise.
Organizations should urgently patch affected Firebox appliances and investigate for compromise, as WatchGuard warned that some branch-office VPN configurations may remain exposed even after vulnerable settings are removed. CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to remediate it within one week; despite more than 115,000 initially exposed unpatched devices, roughly 9,000 reportedly remained unsecured nine months later.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
Nine months after Shadowserver's December finding, nearly 9,000 vulnerable internet-exposed Firebox firewall instances reportedly remained unsecured.
Shadowserver identified more than 115,000 internet-exposed WatchGuard Firebox firewalls that remained unpatched for CVE-2025-14733.
CISA added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog and, under Binding Operational Directive 22-01, required U.S. federal agencies to remediate affected systems within one week.
WatchGuard released security patches for CVE-2025-14733, a critical out-of-bounds-write flaw enabling unauthenticated remote code execution on affected Firebox Fireware OS releases.
One month after WatchGuard patched CVE-2025-9242, CISA classified the Firebox vulnerability as actively exploited. Shadowserver had identified more than 75,000 Firebox firewalls vulnerable to exploitation.
WatchGuard issued a patch for CVE-2025-9242, a remote-code-execution vulnerability in Firebox devices.
WatchGuard confirmed that attackers exploiting CVE-2025-14733 were exfiltrating Firebox appliance configurations and management databases. It advised affected organizations to rotate appliance credentials even after applying the security update.
CISA confirmed that ransomware groups are exploiting the critical WatchGuard Firebox vulnerability CVE-2025-14733, but did not disclose technical or operational details of the attacks.
WatchGuard confirmed real-world exploitation of CVE-2025-14733 and published indicators of compromise to help Firebox customers identify potential compromise. It warned that affected IKEv2 VPN configurations are exposed and that certain branch-office VPN configurations may remain compromisable after vulnerable settings are removed.
CISA previously directed government agencies to patch the actively exploited CVE-2022-23176 vulnerability affecting WatchGuard Firebox and XTM firewalls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard has confirmed that its Firebox firewall devices are being actively targeted due to a critical remote code execution vulnerability, CVE-2025-32978, which allows unauthenticated attackers to execute arbitrary commands remotely. The flaw resides in the Fireware OS Internet Key Exchange (IKE) service and can be exploited if the device is accessible over the internet, potentially giving attackers full control of the firewall. WatchGuard has released emergency patches and indicators of compromise, urging customers to update their firmware immediately or apply temporary workarounds if patching is not possible. The vulnerability affects configurations involving mobile user VPN with IKEv2 and branch office VPNs using IKEv2, even if some configurations have been deleted but others remain. In response to evidence of active exploitation, CISA has added a WatchGuard Firebox vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the significant risk such flaws pose to federal and enterprise networks. CISA's directive requires federal agencies to remediate these vulnerabilities by a set deadline and strongly encourages all organizations to prioritize patching to reduce exposure to cyberattacks. The inclusion in the KEV Catalog underscores the urgency for organizations to address these vulnerabilities as part of their ongoing vulnerability management practices.
Jun 29, 2026
A critical zero-day vulnerability, identified as CVE-2025-14733, has been discovered in WatchGuard Firebox firewalls, allowing remote unauthenticated attackers to execute arbitrary code. The flaw, rated with a CVSS score of 9.3, resides in the `iked` process responsible for handling IKEv2 VPN connections, specifically affecting both Mobile User VPN and Branch Office VPN configurations. Attackers can exploit this out-of-bounds write vulnerability by sending specially crafted requests, potentially leading to full device compromise and firewall hijacking. WatchGuard has confirmed active exploitation of this vulnerability in the wild, with threat actors targeting exposed devices. Indicators of compromise include suspicious IP addresses, unusually large certificate payloads in IKE_AUTH requests, long certificate chains, and unexpected crashes of the `iked` process. Administrators are urged to apply the latest security updates immediately and review their logs for signs of compromise. The vulnerability affects Fireware OS versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.5, and 2025.1 through 2025.1.3.
Jun 29, 2026
A critical out-of-bounds write vulnerability, tracked as CVE-2025-9242, has been discovered in WatchGuard Fireware OS, affecting versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1. This flaw allows remote, unauthenticated attackers to execute arbitrary code on vulnerable Firebox firewall devices by exploiting a missing length check during the IKE handshake process. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation, and has mandated that Federal Civilian Executive Branch (FCEB) agencies apply patches by December 3, 2025. As of mid-November, over 54,000 Firebox devices remain exposed globally, with the highest concentrations in the U.S., Italy, the U.K., Germany, and Canada. WatchGuard released patches for the vulnerability on September 17, 2025, but only confirmed active exploitation in late October. CISA has emphasized the significant risk posed by this flaw, urging all organizations—not just federal agencies—to prioritize patching due to the attractiveness of firewall devices as targets for threat actors. The vulnerability's exploitation path allows attackers to bypass authentication, as the vulnerable code is executed before certificate validation. Organizations unable to apply mitigations are advised to discontinue use of affected products to prevent compromise.
Jun 29, 2026