Loading story…
WatchGuard released updates for Fireware OS addressing 15 vulnerabilities in Firebox appliances, led by CVE-2026-86131, a critical CVSS 9.2 code-injection flaw in BOVPN over TLS client configuration handling. An attacker that controls a remote VPN server can exploit the issue when a Firebox connects to it, executing arbitrary commands as root on the appliance. Fixed releases are Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.
The update also fixes high-severity issues including CVE-2026-86132 and CVE-2026-86133, integer-underflow flaws in IKEv2 processing that can crash the iked process with crafted encrypted messages; CVE-2026-81433, an adjacent-network DHCP fingerprinting daemon buffer overflow; and CVE-2026-86101, which can grant some authenticated SAML users unauthorized Mobile VPN with SSL access. WatchGuard said it has no evidence of active exploitation, but organizations should urgently update affected Firebox devices, particularly deployments using BOVPN over TLS.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
WatchGuard released security updates addressing 15 Fireware OS vulnerabilities affecting Firebox appliances, including critical CVE-2026-86131. The updates fixed the flaws in versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21; WatchGuard said it was unaware of in-the-wild exploitation.
WatchGuard patched two critical internal-API vulnerabilities that could let an unauthenticated attacker establish an API session and execute shell commands, plus a high-severity command-injection flaw. The fixes were released in WatchGuard AP version 3.4.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecert.gov.py
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard published security advisories for multiple **Fireware OS** vulnerabilities affecting **Firebox** appliances and related deployments, and the Canadian Centre for Cyber Security urged organizations to apply updates. The issues include an **out-of-bounds write** that could allow a privileged, authenticated administrator to achieve **root-level arbitrary code execution** via an exposed management interface (**CVE-2026-3342**), and a **filesystem integrity check bypass** that could allow an attacker to maintain **limited persistence** by using a maliciously crafted firmware update package (**CVE-2026-3344**). A separate advisory also notes a **reflected XSS** issue in the Fireware Web UI (**CVE-2026-3343**). Affected versions span multiple Fireware OS branches, including **12.0–12.11.7**, **12.5.9–12.5.16** (T15/T35 models), and **2025.1–2026.1.1**, with additional impact noted for **11.x** in the out-of-bounds write advisory (11.x is end-of-life). WatchGuard’s fixes are available in **12.11.8**, **12.5.17**, and **2026.1.2** (depending on branch/model), and no workaround was listed for the integrity-check bypass or out-of-bounds write issues; organizations should prioritize patching and ensure management interfaces are not unnecessarily exposed.
Jul 3, 2026
WatchGuard released fixes for five **critical** vulnerabilities in Fireware OS and WatchGuard Dimension, all rated CVSS v4 9.3. Three flaws in the internet-exposed `iked` IKE/VPN daemon—including the pre-authentication stack buffer overflow tracked as `CVE-2026-19318`—could allow unauthenticated attackers to execute code by sending crafted VPN traffic, creating a direct perimeter-compromise risk. A fourth Fireware issue affects the deprecated Mobile Security `epm` service, while a WatchGuard Dimension vulnerability could let a low-privileged administrator hijack a Super Administrator session. WatchGuard reported no confirmed exploitation or public proof-of-concept code, but organizations should apply the available updates immediately; where patching is delayed, VPN and management interfaces should be limited to trusted networks.
Sep 1, 2026
A critical vulnerability, tracked as CVE-2025-9242, has been discovered in WatchGuard's Fireware OS, affecting a wide range of Firebox network security appliances. This flaw is an out-of-bounds write in the 'iked' process, which is responsible for handling IKEv2 VPN negotiations. The vulnerability allows remote attackers to execute arbitrary code on affected devices without authentication, posing a severe risk to organizations relying on these appliances for network security. The issue specifically impacts devices configured with mobile user VPNs or branch office VPNs using IKEv2 with dynamic gateway peers. Security researchers have demonstrated that attackers can exploit this bug by sending specially crafted IKEv2 packets during the IKE_SA_AUTH phase, triggering a buffer overflow in the ike2_ProcessPayload_CERT function. Once exploited, attackers can gain control of the instruction pointer, establish Python interactive shells over TCP, and escalate to a full Linux shell by remounting filesystems and deploying BusyBox binaries. The vulnerability has been assigned a CVSS score of 9.3, underscoring its critical nature. According to scans by The Shadowserver Foundation, nearly 76,000 Firebox appliances remain exposed and vulnerable on the public internet, with the highest concentrations in the United States, Germany, Italy, the United Kingdom, Canada, and France. Affected Fireware OS versions include 11.10.2 through 11.12.4_Update1, the entire 12.0 series up to 12.11.3, and the 2025.1 release, impacting both older and newer Firebox models. WatchGuard has released patches in versions 12.3.1_Update3, 12.5.13, 12.11.4, and 2025.1.1 to address the vulnerability. Devices running version 11.x are no longer supported and will not receive security updates, prompting the vendor to recommend upgrading to a supported version. For appliances configured only with Branch Office VPNs to static gateway peers, WatchGuard has provided documentation for securing connections as a temporary workaround. The vulnerability transforms trusted security appliances into potential entry points for attackers, threatening the integrity of network defenses. Organizations are urged to assess their Firebox deployments, prioritize patching, and review VPN configurations to mitigate the risk. The widespread exposure of vulnerable devices highlights the urgency of remediation efforts. WatchGuard's disclosure and the subsequent public scanning have brought significant attention to the issue, emphasizing the importance of timely patch management in network security infrastructure. Failure to address this vulnerability could result in unauthorized access, lateral movement, and compromise of sensitive internal networks. The incident serves as a stark reminder of the risks posed by critical flaws in security appliances and the need for continuous monitoring and rapid response.
Jun 29, 2026