CISA: WatchGuard RCE flaw now exploited in ransomware attacks
Source Bleeping Computer
Exploited in the wild · KEV due 26 Dec 2025 : apply the vendor's fix or mitigations to affected systems now.
Data as of 09/10/2026, 09:22:31 UTC
- KEV deadline
- 12/26/2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 19 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wild: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by WatchGuard
, 4 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 40 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
, the same day as disclosure
KEV remediation due
US federal deadline
, 7 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
WatchGuard released official patches for CVE-2025-14733 in December 2025. Organizations should apply these patches immediately to affected Fireware OS versions. WatchGuard has also provided indicators of compromise to help detect exploitation. CISA has mandated patching for federal agencies and included this vulnerability in its Known Exploited Vulnerabilities catalog. If patching is not immediately possible, organizations should review and disable vulnerable VPN configurations, particularly IKEv2 VPN and branch office VPNs to static gateway peers, to reduce exposure. Continuous monitoring for signs of compromise using provided indicators is recommended.
Description
A critical remote code execution (RCE) vulnerability in WatchGuard Firebox firewalls (CVE-2025-14733) is actively exploited by ransomware gangs. The flaw allows unauthenticated attackers to execute malicious code remotely via an out-of-bounds write. It affects Fireware OS versions 11.x and later, 12.x and later, and 2025.1 through 2025.1.3. Despite patches released in December 2025, many devices remain unpatched and exposed online. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and included this vulnerability in its Known Exploited Vulnerabilities catalog, mandating urgent patching for federal agencies. WatchGuard has provided indicators of compromise to assist detection. The vulnerability is particularly risky when IKEv2 VPN is configured, but residual risk remains if certain VPN configurations persist.
Impact
The vulnerability enables unauthenticated remote attackers to execute arbitrary code on affected WatchGuard Firebox firewalls, potentially leading to full compromise of the device. This has been actively exploited by ransomware gangs, increasing the risk of ransomware deployment and network disruption. The exposure of a large number of unpatched devices online amplifies the threat. The impact is significant for organizations using vulnerable Firebox firewalls, especially those with IKEv2 VPN configurations or residual VPN settings. Successful exploitation can undermine network security and facilitate ransomware attacks.