WatchGuard Firebox RCE Exploited by Ransomware Groups
Active Exploitation · 3 sources · Updated 2mo ago · First seen Sep 10, 2026
CISA has confirmed ransomware groups are exploiting CVE-2025-14733, a critical unauthenticated remote-code-execution flaw in WatchGuard Firebox firewalls. The out-of-bounds write vulnerability affects multiple Fireware OS 11.x, 12.x, and 2025.1 releases, particularly devices using vulnerable IKEv2 VPN configurations; WatchGuard has issued patches, confirmed active exploitation, and published indicators of compromise.
Organizations should urgently patch affected Firebox appliances and investigate for compromise, as WatchGuard warned that some branch-office VPN configurations may remain exposed even after vulnerable settings are removed. CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to remediate it within one week; despite more than 115,000 initially exposed unpatched devices, roughly 9,000 reportedly remained unsecured nine months later.
