CISA Warns of Active Exploitation of WatchGuard Firebox Out-of-Bounds Write Flaw

CISA has added a critical vulnerability affecting WatchGuard Firebox firewalls to its Known Exploited Vulnerabilities (KEV) catalog, warning of active exploitation in the wild, according to The Cybersecurity and Infrastructure Security Agency (CISA). The flaw is tracked as CVE-2025-9242 and resides in the OS iked process, enabling remote, unauthenticated attackers to execute arbitrary code, with the vulnerability classified as CWE-787 (Out-of-bounds Write).

CISA notes that exploitation could let attackers write data beyond memory boundaries, potentially taking control of the affected firewall and allowing movement into internal networks. The agency has given organisations until 3 December 2025 to address the flaw, underscoring the severity and the ongoing exploitation.

Guidance from CISA emphasises applying mitigations per WatchGuard’s instructions and prioritising patching as updates become available, with additional steps for cloud services and, if patches are unavailable, discontinuing use of the affected devices. The warning highlights that remote code execution flaws in network infrastructure remain attractive to threat actors, with a deadline-driven remediation plan to avert breaches.