Executive brief
A security vulnerability has been identified in WatchGuard Fireware OS, the operating system used to manage Firebox network security appliances. An authorized administrator could potentially execute malicious code on the device by sending specially crafted requests through the management web interface. If exploited, this could allow an attacker to gain full control over the firewall, potentially leading to network-wide disruptions or unauthorized access to internal traffic.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the ikestubd process of WatchGuard Fireware OS. The flaw is reachable via specially crafted requests sent to the Management Web UI. While the attack vector is network-based, exploitation requires high privileges (authenticated privileged user). Successful exploitation allows for arbitrary code execution with the permissions of the affected process. The vulnerability affects multiple versions of Fireware OS across various Firebox hardware and virtual models. Patches have been released in versions 2026.2.1 and 12.12.1.
Affected products
- WatchGuard Fireware OS 12.1 through 12.12, 12.5 through 12.5.18, 2025.1 through 2026.2
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched