U.S. CISA adds a flaw in WatchGuard Fireware OS to its Known Exploited Vulnerabilities catalog

CISA has added a WatchGuard Fireware OS vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2025-14733 with a CVSS score of 9.3. The flaw is a critical out-of-bounds write that can be exploited remotely and without authentication, enabling an attacker to execute arbitrary code. It affects WatchGuard Firebox OS branches, including versions 11.10.2–11.12.4_Update1, 12.0–12.11.5, and 2025.1–2025.1.3, and specifically impacts IKEv2 VPN services configured with a dynamic gateway peer.

According to the advisory published by WatchGuard, the vulnerability may persist even if certain VPN configurations have been deleted if a branch office VPN to a static gateway remains configured. CISA orders federal agencies to fix the vulnerabilities by 26 December 2025, and the article notes that the issue was added to the KEV catalogue by CISA, with the discovery and disclosure surrounding the Fireware OS flaw framed as urgent due to pre-auth remote exploitation. 20 December 2025.