WatchGuard has raised the alarm after disclosing three new high-severity vulnerabilities affecting the Fireware OS operating system of its popular security appliances Firebox . The specific security flaws could, under certain conditions, allow an attacker with administrator privileges to execute arbitrary code and essentially gain complete control of the firewall .
The company has already released patched versions of Fireware OS, urging all organizations and infrastructure managers to immediately proceed with the necessary upgrades. The vulnerabilities were rated with a score of 8.6 according to the CVSS v4.0 system, which ranks them among the most serious threats for business environments.
WatchGuard Firebox: What are the three security vulnerabilities?
The vulnerabilities have been registered with the codes CVE-2026-13053, CVE-2026-13050 and CVE-2026-13054 and concern different subsystems of Fireware OS.
The first is related to an out-of-bounds write in the CLI command-line interface. A authenticated user with elevated privileges can, through specially crafted commands, cause arbitrary code to be executed with extremely high privileges.
See also: Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Credentials
The second vulnerability is located in the networkd and is triggered by specially crafted requests to the Web UI management environment. Again, an administrator with valid credentials could gain the ability to execute malicious code within the device's operating system.
The third is vulnerability a path traversal, which allows files to be written to arbitrary file system locations. Through this, an attacker could modify configuration files, startup scripts, or even critical executable files, gaining permanent access to the device.
What does this mean for businesses?
Although these attacks already require valid administrator credentials, experts warn that this scenario is not as unlikely as it seems.
In many cyberattacks, attackers initially gain access through phishing, password theft, or a compromise of an administrator workstation. Once they have the necessary privileges, they can exploit such vulnerabilities to install backdoors, change firewall rules, steal VPN credentials, or gain complete control of the network infrastructure.
Because Fireboxes are the first line of defense for many businesses, a successful breach can pave the way for further attacks on internal systems, servers, and critical business services.
Which versions are affected?
WatchGuard confirms that the vulnerabilities affect a large number of Fireware OS versions, both on physical devices and in virtual installations or cloud environments.
Specifically, the 11.x, 12.x and later versions up to version 2026.2. This means that thousands of installations worldwide may need to upgrade immediately.
Special attention is required for organizations still using 11.x versions, as these have now been designated as End of Life and will not receive new security updates.
At the same time, for older Firebox T15 and T35 models, the company points out that certain issues in the 12.5.x series remain unresolved, making it necessary to migrate to newer supported hardware where possible.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: FortiBleed: Credential theft linked to INC and Lynx Ransomware
The fixes have already been released
WatchGuard has released Fireware OS versions 2026.2.1 and 12.12.1, which address the specific vulnerabilities.
Organizations using version 2025.1 are encouraged to move directly to the 2026.2.1 series, while those on the 12.x series should upgrade to at least version 12.12.1. For installations still based on older 11.x versions, a full migration process is required, as this platform is no longer officially supported.
It is worth noting that the company does not provide any temporary workaround to eliminate the vulnerabilities. Installing the new versions is the only permanent solution.
How can organizations be protected?
Until the upgrades are complete, experts recommend implementing additional security measures. Access to the Firebox management interfaces should be restricted to fully authorized users and from trusted networks, while enabling multi-factor authentication (MFA) for all administrator accounts is now considered essential.
See also: CVE-2026-45659: SharePoint RCE bug in CISA KEV
Equally important is to constantly monitor logs for suspicious activity via CLI or Web UI, as well as regularly changing administrator credentials. Recent revelations are a reminder that even the most trusted security platforms can have critical vulnerabilities, which is why timely installation of updates and adoption of a multi-layered cybersecurity strategy remain the most important factors in protecting modern corporate networks.
