Is CVE-2026-13384 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13384 being exploited in the wild.

How severe is CVE-2026-13384?

Informational severity, with a CVSS score of 8.6, published 3 July 2026.

Which products and versions are affected?

Watchguard Fireware 12.1 through 12.12, 12.5 through 12.5.18, 2025.1 through 2026.2.

Is there a fix for CVE-2026-13384?

A patch was published on 2026-07-02: Fixes released in versions 12.12.1 and 2026.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13384 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13384?

Check whether you run Watchguard Fireware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13384: WatchGuard Fireware OS out-of-bounds write in wgagent

CVE-2026-13384 · Severity: info · CVSS 8.6 · Published 2026-07-03

A security vulnerability exists in the management interface of WatchGuard Firebox firewalls, which are used to protect corporate networks. An authorized administrator could exploit this flaw to take full control of the device and execute unauthorized commands. This could lead to a complete compromise of the firewall, potentially allowing an attacker to intercept network traffic or disable security protections.

Technologies: Watchguard Fireware. Vendors: Watchguard.

Quick answers

Is CVE-2026-13384 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13384 being exploited in the wild.
How severe is CVE-2026-13384?: Informational severity, with a CVSS score of 8.6, published 3 July 2026.
Which products and versions are affected?: Watchguard Fireware 12.1 through 12.12, 12.5 through 12.5.18, 2025.1 through 2026.2.
Is there a fix for CVE-2026-13384?: A patch was published on 2026-07-02: Fixes released in versions 12.12.1 and 2026.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13384 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13384?: Check whether you run Watchguard Fireware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) write vulnerability (CWE-787) exists within the 'wgagent' process of WatchGuard Fireware OS. The flaw is reachable via the Management Web UI. An attacker with high privileges (authenticated) can send specially crafted requests to trigger the memory corruption, leading to arbitrary code execution on the underlying operating system. The vulnerability affects multiple versions across the 12.x and 2025.x branches. Patches have been released in versions 12.12.1 and 2026.2.1, though some legacy models (T15/T35) remain unresolved according to the advisory.

Affected products

WatchGuard Fireware OS 12.1 through 12.12, 12.5 through 12.5.18, 2025.1 through 2026.2

Timeline

2026-07-02: advisory: WatchGuard published advisory WGSA-2026-00021
2026-07-02: patched: Fixes released in versions 12.12.1 and 2026.2.1
2026-07-03: disclosed: NVD publication date

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00021

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.