Threat database

An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

CVE-2026-18145 is a high-severity stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS. It allows an authenticated administrator to crash the service or potentially execute arbitrary code by sending a specially crafted management request. The vulnerability requires administrator privileges and does not require user interaction. No known exploits are reported in the wild. The vendor has not provided explicit patch or remediation information.

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

CVE-2026-13046 is a high-severity vulnerability in WatchGuard Fireware OS affecting its SAML single sign-on session handling component (samld). It involves deserialization of untrusted data, allowing an attacker with file write access on the appliance to execute arbitrary code within the samld service context. The vulnerability affects multiple version ranges of Fireware OS prior to certain patch levels.

CVE-2026-86131 is a critical code injection vulnerability in WatchGuard Fireware OS affecting the BOVPN Over TLS client configuration. An attacker controlling the remote VPN server can execute arbitrary commands with root privileges on the connecting Firebox device. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact. No official patch or remediation details are provided in the available data. The affected versions include 12.0, 2025.0, and 2026.3 of Fireware OS.

CVE-2026-13224 is a path traversal vulnerability in the WatchGuard Fireware OS WebUI management agent. It allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. The vulnerability affects multiple versions of Fireware OS, including version 12.0. It has a high severity score of 8.2 under CVSS 4.0. No known exploits are reported in the wild, and no official patch information is provided in the available data.

CVE-2026-86133 is an integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked). A remote attacker who completes the initial IKEv2 handshake can send a specially crafted encrypted IKEv2 message to crash the iked process, causing a denial of service. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. The CVSS 4.0 score is 8.2, indicating high severity. No known exploits are reported in the wild. Patch status is not provided in the input data.

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVE-2026-86136 is a high-severity vulnerability in WatchGuard Fireware OS affecting the wgagent management daemon. It involves a missing authorization check in the session initialization function, allowing an authenticated low-privileged user, including read-only or guest administrators, to crash the wgagent process and read arbitrary files accessible to the daemon via a crafted management API request.

CVE-2026-86132 is an integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked). A remote, unauthenticated attacker can cause the iked process to crash by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite. This vulnerability affects multiple versions of Fireware OS prior to their respective fixed releases. The CVSS 4.0 score is 8.2, indicating high severity.

A NULL pointer dereference vulnerability exists in Fireware OS's NetFlow packet-processing feature. This flaw allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet. The vulnerability is identified as CVE-2026-86128 and is categorized as high severity. No affected versions or patch information are provided. There are no known exploits in the wild at this time.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

CVE-2026-95676 is a high-severity vulnerability in WatchGuard AuthPoint Authentication Gateway versions 4.2.2 up to but not including 7.5.1. It involves a missing or improper authentication check in the LDAP Sync first-factor authentication process, allowing a remote attacker to bypass single-factor password verification under non-default operating conditions. However, additional authentication factors remain enforced, limiting the overall impact.