WatchGuard Patches Critical Vulnerabilities

WatchGuard released patches addressing over two dozen vulnerabilities, including five critical flaws leading to remote code execution and account takeover. Three critical vulnerabilities impact the Fireware OS iked process: a heap buffer overflow (CVE-2026-19313), a stack-based buffer overflow (CVE-2026-19318), and a type confusion (CVE-2026-19315). These can be exploited without authentication by sending crafted network traffic. Additionally, a critical stack-based buffer overflow (CVE-2026-13086) in the Endpoint Protection Manager service and an account takeover vulnerability (CVE-2026-78174) in WatchGuard Dimension were patched. The critical vulnerabilities have CVSS scores of 9.3. Patches were released in Fireware OS versions 2026.2.2, 12.12.2, 12.5.20, and Dimension 2.3.1. No known exploitation in the wild has been reported.

Successful exploitation of the critical vulnerabilities could allow unauthenticated remote attackers to execute arbitrary code on affected devices, potentially leading to full system compromise. The account takeover vulnerability in WatchGuard Dimension could allow low-privileged administrators to hijack super admin sessions. These impacts pose significant risks to confidentiality, integrity, and availability of affected systems.

WatchGuard has released official patches addressing these vulnerabilities in Fireware OS versions 2026.2.2, 12.12.2, 12.5.20, and Dimension version 2.3.1. Administrators should apply these updates promptly to mitigate the risks. WatchGuard is not aware of any active exploitation, indicating that patching is the primary recommended action.