CVE-2026-13728 identifies a vulnerability in WatchGuard Fireware OS where, under certain conditions in a FireCluster deployment using the Access Portal feature, a hard-coded encryption key is used to encrypt saved credentials. This practice is classified under CWE-798 (Use of Hard-coded Credentials), which can lead to compromised credential confidentiality if the key is discovered. The affected versions include 12.1 up to and including 12.12, and 2025.1 up to and including 2026.2. Devices not supporting Access Portal or standalone Fireboxes are not impacted. No official remediation or patch information is provided in the available data.

The use of a hard-coded encryption key for credential encryption may allow an attacker with sufficient access to decrypt saved credentials, potentially leading to unauthorized access to Access Portal resources within a FireCluster environment. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.9, indicating a moderate risk that requires privileged access and partial attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should evaluate the risk of using FireCluster deployments with Access Portal enabled and consider limiting access to trusted administrators. Monitoring vendor communications for updates or patches is recommended.