This vulnerability involves improper neutralization of input during web page generation (CWE-79), allowing stored XSS attacks in WatchGuard Fireware OS's Autotask Technology Integration module. It affects multiple versions of Fireware OS, specifically 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2. The issue is an additional attack vector complementing CVE-2025-13938. No official remediation or patch has been documented as of the published date.

Successful exploitation could allow an attacker with high privileges and partial user interaction to execute stored cross-site scripting attacks, potentially leading to session hijacking or unauthorized actions within the affected system's web interface. The CVSS vector indicates network attack vector, low attack complexity, and requires high privileges and partial user interaction, with limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, limit access to the affected modules and monitor for suspicious activity related to the Autotask Technology Integration module.