Is CVE-2026-13054 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13054 being exploited in the wild.

How severe is CVE-2026-13054?

Informational severity, with a CVSS score of 8.6, published 3 July 2026.

Which products and versions are affected?

Watchguard Fireware 11.0 to 11.12.4_Update1, 12.0 to 12.12, 12.5 to 12.5.18, 2025.1 to 2026.2.

Is there a fix for CVE-2026-13054?

A patch was published on 2026-07-02: Resolved versions 12.12.1 and 2026.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13054 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13054?

Check whether you run Watchguard Fireware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13054: WatchGuard Fireware OS path traversal in Management Web UI

CVE-2026-13054 · Severity: info · CVSS 8.6 · Published 2026-07-03

A security vulnerability exists in the management interface of WatchGuard Firebox firewalls, which are used to secure corporate networks. An attacker with administrative access could bypass security restrictions to write unauthorized files to the device's internal storage. This could lead to a complete takeover of the firewall, potentially allowing the attacker to disrupt network traffic or gain further access to the internal network.

Technologies: Watchguard Fireware. Vendors: Watchguard.

Quick answers

Is CVE-2026-13054 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13054 being exploited in the wild.
How severe is CVE-2026-13054?: Informational severity, with a CVSS score of 8.6, published 3 July 2026.
Which products and versions are affected?: Watchguard Fireware 11.0 to 11.12.4_Update1, 12.0 to 12.12, 12.5 to 12.5.18, 2025.1 to 2026.2.
Is there a fix for CVE-2026-13054?: A patch was published on 2026-07-02: Resolved versions 12.12.1 and 2026.2.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13054 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13054?: Check whether you run Watchguard Fireware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Management Web UI of WatchGuard Fireware OS. The flaw is caused by improper validation of user-supplied paths, allowing an authenticated attacker with high privileges to escape the intended directory and write arbitrary files to the Firebox filesystem. The attack is reachable over the network via the management interface. Successful exploitation could lead to full system compromise or persistent unauthorized access. Patches are available in versions 12.12.1 and 2026.2.1, though some older versions (11.x and 12.5.x) remain unresolved or are end-of-life.

Affected products

WatchGuard Fireware OS 11.0 to 11.12.4_Update1, 12.0 to 12.12, 12.5 to 12.5.18, 2025.1 to 2026.2

Timeline

2026-07-02: advisory: WatchGuard published advisory WGSA-2026-00028
2026-07-02: patched: Resolved versions 12.12.1 and 2026.2.1 released

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.