Critical WatchGuard Firebox OS Flaws Let Attackers Execute Code

Key Takeaways

• Three high-severity vulnerabilities (CVE-2026-13053, CVE-2026-13050, CVE-2026-13054) have been discovered in WatchGuard Firebox appliances running Fireware OS.
• These flaws allow authenticated attackers to execute arbitrary code and achieve full control over affected devices.
• All vulnerabilities are rated 8.6 on the CVSS v4.0 scale, indicating high severity but requiring authenticated access.
• Patches are available in Fireware OS versions 2026.2.1 and 12.12.1, with older, end-of-life versions requiring migration.

Critical Flaws Expose WatchGuard Firebox Devices to Remote Code Execution

Cybersecurity researchers have uncovered a trio of high-impact vulnerabilities within WatchGuard Firebox devices utilizing Fireware OS. These critical flaws could enable authenticated attackers to gain complete control over affected appliances by executing arbitrary code.

WatchGuard has officially acknowledged these three significant vulnerabilities, all of which carry a CVSS v4.0 score of 8.6. The vendor has already deployed patches in recent firmware updates to address these issues.

Details of the Vulnerabilities

The vulnerabilities, identified as CVE-2026-13053, CVE-2026-13050, and CVE-2026-13054, facilitate arbitrary code execution and arbitrary file writing. Exploitation requires an attacker to be logged in as an administrator, leveraging either the management Command Line Interface (CLI) or the Web UI.

CVE-2026-13053 (WGSA-2026-00030) involves an out-of-bounds write within the Fireware OS CLI command handler. A privileged, authenticated user can exploit this by issuing a specially crafted CLI command, leading to the execution of arbitrary code.

CVE-2026-13050 (WGSA-2026-00029) is another out-of-bounds write, this time affecting the networkd process. This flaw can be triggered through malicious requests sent to the Management Web UI, also granting arbitrary code execution capabilities to a privileged administrator.

CVE-2026-13054 (WGSA-2026-00028) is a path-traversal vulnerability found in the Management Web UI. This allows a logged-in attacker to write arbitrary files to any location on the Firebox filesystem. This capability can be chained with other techniques, such as modifying startup scripts, binaries, or configuration files, to achieve code execution.

All three issues are classified as “High” impact by WatchGuard. Their identical CVSS v4.0 vectors indicate low attack complexity but emphasize the necessity of high-privileged credentials for successful exploitation.

Affected Systems and Remediation

According to WatchGuard, these vulnerabilities impact a wide array of Fireware OS versions across hardware, virtual, and cloud-based Firebox deployments. Specifically, Fireware OS versions 11.0 through 11.12.4_Update1, 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2 are all susceptible.

It is crucial to note that legacy 11.x releases have reached their end-of-life status. This means customers still operating on these older builds will not receive patches and must upgrade to supported branches to mitigate the risk. Furthermore, advisories indicate that the 12.5.x line for small-form T15 and T35 models remains “Unresolved,” highlighting the urgency of migrating off deprecated platforms where feasible.

Since these are post-authentication flaws, an attacker must first compromise administrator credentials, pivot from a compromised management workstation, or exploit insider access. Once authenticated, an attacker could leverage the CLI out-of-bounds write to execute arbitrary code with high privileges, install backdoors, alter firewall rules, or exfiltrate sensitive data such as configuration files and VPN secrets.

Similarly, the networkd vulnerability allows a malicious administrator to weaponize Web UI requests to achieve the same level of code execution via the management plane. The path traversal flaw, enabling arbitrary file writes, further expands attack options by permitting overwrites of critical system files, cron jobs, or boot scripts, facilitating persistent access that can be challenging to detect.

WatchGuard has released Fireware OS 2026.2.1 and 12.12.1 as the primary versions containing fixes for these vulnerabilities. Customers on 2025.1 should upgrade to 2026.2.1, while those on 12.x must update to at least 12.12.1. Deployments still on 11.x require a complete migration due to their end-of-life status.

The vendor has not provided any workarounds for these three issues, making patching the sole effective remediation strategy.

What You Should Do

• Immediately upgrade all affected WatchGuard Firebox appliances to Fireware OS 2026.2.1 or 12.12.1, depending on your current version.
• If you are running an end-of-life 11.x version, plan and execute a migration to a supported Fireware OS branch without delay.
• Strictly limit network access to Firebox management interfaces (CLI and Web UI).
• Enforce multi-factor authentication (MFA) for all administrator accounts.
• Actively monitor administrator-level activity for any unusual CLI commands or Web UI operations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.