This vulnerability (CVE-2026-13384) involves an out-of-bounds write in the wgagent process of WatchGuard Fireware OS. It allows an authenticated user with high privileges to execute arbitrary code by sending specially crafted requests to the Management Web UI. The affected versions include Fireware OS 12.1 up to and including 12.12, and 2025.1 up to and including 2026.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could lead to arbitrary code execution with high privileges on the affected Fireware OS devices. This compromises the confidentiality, integrity, and availability of the system, potentially allowing an attacker to fully control the device. The vulnerability requires authenticated privileged access, limiting exposure to trusted users or attackers who have already gained such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict privileged user access to the Management Web UI to trusted personnel only and monitor for unusual activity. Avoid exposing the Management Web UI to untrusted networks.