Is CVE-2025-12026 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-12026 being exploited in the wild.

How severe is CVE-2025-12026?

High severity, with a CVSS score of 7.2, published 4 December 2025.

Which products and versions are affected?

Watchguard Fireware OS 2025.1.x (before 2025.1.3), 12.0–12.11.5.

Is there a fix for CVE-2025-12026?

A patch was published on 2025-12-04: Patches released: Fireware OS 2025.1.3, 12.11.5, and 12.5.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-12026 attacked?

It is attacked over the network.

Am I affected by CVE-2025-12026?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12026: WatchGuard Fireware OS out-of-bounds write in certd

CVE-2025-12026 · Severity: high · CVSS 7.2 · Published 2025-12-04

WatchGuard Fireware OS is the core operating system that powers WatchGuard Firebox firewalls, which protect corporate networks by inspecting and controlling traffic. An authenticated administrator with privileged access can exploit a buffer overflow vulnerability in the certificate request command to execute arbitrary code on the firewall, potentially allowing complete compromise of the device and access to network traffic it protects.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2025-12026 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-12026 being exploited in the wild.
How severe is CVE-2025-12026?: High severity, with a CVSS score of 7.2, published 4 December 2025.
Which products and versions are affected?: Watchguard Fireware OS 2025.1.x (before 2025.1.3), 12.0–12.11.5.
Is there a fix for CVE-2025-12026?: A patch was published on 2025-12-04: Patches released: Fireware OS 2025.1.3, 12.11.5, and 12.5.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12026 attacked?: It is attacked over the network.
Am I affected by CVE-2025-12026?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an out-of-bounds write vulnerability (CWE-787) in the certificate daemon (certd) component of WatchGuard Fireware OS, triggered through specially crafted CLI commands. The vulnerability requires authenticated access with elevated privileges and network connectivity to the firewall's management interface. An attacker with admin credentials can send malformed certificate request commands via the CLI to overflow a buffer in the certd process, allowing arbitrary code execution with the privileges of the certd daemon. Patches are available in Fireware OS 2025.1.3, 12.11.5, and 12.5.14.

Affected products

WatchGuard Fireware OS 2025.1.x (before 2025.1.3), 12.0–12.11.5

Timeline

2025-12-04: disclosed
2025-12-04: patched: Patches released: Fireware OS 2025.1.3, 12.11.5, and 12.5.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.