WatchGuard Firebox Vulnerabilities Let Admin Attackers Run Code on Firewalls

WatchGuard has patched three high-severity Fireware OS vulnerabilities that affect Firebox firewall appliances and could expose organizations to serious compromise if attackers already have privileged administrator access.

The flaws were disclosed on July 2, 2026, and affect Firebox devices running multiple Fireware OS branches. Two of the bugs allow arbitrary code execution, while the third allows arbitrary file writes on the firewall file system.

The most serious risk comes from the management plane. According to WatchGuard, one of the flaws can be triggered through a specially crafted CLI command by an authenticated privileged user.

Three WatchGuard Firebox Bugs Patched

The vulnerabilities are tracked as CVE-2026-13053, CVE-2026-13050, and CVE-2026-13054. All three carry a CVSS v4.0 score of 8.6 and a High severity rating.

CVE-2026-13053 is an out-of-bounds write vulnerability in the Fireware OS CLI. It can allow a privileged authenticated user to execute arbitrary code through a specially crafted CLI command.

CVE-2026-13050 is another out-of-bounds write issue, this time in the networkd process. The WatchGuard advisory says it can allow arbitrary code execution through specially crafted requests to the Management Web UI.

CVE	Issue type	Attack path	Impact
CVE-2026-13053	Out-of-bounds write	Management CLI	Arbitrary code execution
CVE-2026-13050	Out-of-bounds write	Management Web UI	Arbitrary code execution
CVE-2026-13054	Path traversal	Management Web UI	Arbitrary file write

Path Traversal Bug Expands the Attack Surface

The third flaw, CVE-2026-13054, affects the Fireware OS Management Web UI. WatchGuard says the path traversal vulnerability allows a privileged authenticated attacker to write arbitrary files on the Firebox file system.

That makes the bug dangerous even though WatchGuard describes it differently from the two code execution flaws. Arbitrary file write vulnerabilities can help attackers alter files, tamper with configuration data, or support persistence after access to the appliance.

Firewall appliances often sit at sensitive network boundaries. If an attacker gains control of a management account, flaws in the management interface can turn stolen credentials into deeper access across the network.

Affected Fireware OS Versions

WatchGuard says the vulnerabilities affect Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2.

The 11.x branch has reached end of life, so organizations still running those versions should plan a migration rather than wait for a fix. For T15 and T35 models on the 12.5.x branch, WatchGuard lists the issue as unresolved.

The fixed versions are Fireware OS 2026.2.1 for the 2025.1 branch and Fireware OS 12.12.1 for the 12.x branch.

• Upgrade Fireware OS 2025.1 deployments to 2026.2.1.
• Upgrade Fireware OS 12.x deployments to 12.12.1 or later.
• Replace or migrate Fireware OS 11.x deployments because the branch is end of life.
• Review T15 and T35 appliances on 12.5.x, where WatchGuard lists the fix as unresolved.
• Restrict management access to trusted admin networks only.

No Workaround Listed by WatchGuard

WatchGuard lists all three vulnerabilities as resolved, but it does not list a workaround for them. That makes patching the main remediation step for affected devices.

Because exploitation requires high-privileged authentication, these flaws are not the same as unauthenticated internet-facing remote code execution bugs. Still, the risk remains serious because attackers often target firewall administrator accounts through phishing, credential theft, reused passwords, or compromised management systems.

Organizations should check which Fireware OS version they run, confirm whether their Firebox model remains supported, and schedule emergency maintenance where exposed management interfaces or high-risk admin accounts exist.

Why These Firebox Flaws Matter

Firewalls protect network edges, VPN access, traffic rules, and security policies. A compromised firewall can give attackers a valuable foothold inside a company network.

With code execution on the appliance, an attacker could attempt to alter firewall rules, inspect sensitive configuration data, modify VPN settings, or create persistence. The exact impact depends on the device configuration, exposed services, and account privileges.

Security teams should also review administrator activity logs after patching. Any unusual CLI use, unexpected Web UI changes, new admin accounts, or modified configuration files should trigger further investigation.

Recommended Actions for Admins

Administrators should prioritize patching systems that expose management access to broad internal networks, MSP environments, remote administration paths, or jump hosts used by multiple operators.

Access to the Firebox Management Web UI and CLI should be limited to trusted IP addresses. Admin accounts should use unique passwords and multi-factor authentication where supported.

After the upgrade, teams should export and review configuration backups, check admin account lists, and monitor logs for signs of suspicious management-plane activity.

FAQ