Over 71,000 WatchGuard Devices Exposed to Remote Code Execution Attacks

Security researchers have warned that over 71,000 WatchGuard Fireware OS devices were exposed to remote code execution attacks, with the vulnerability tracked as CVE-2025-9242 and described as an Out-of-Bounds Write in the IKEv2 ISAKMP component. According to Shadowserver Foundation, daily data published on 18 October 2025 showed over 71,000 vulnerable instances visible in a Vulnerable ISAKMP reportings feed, with the US accounting for 23.2K of the exposed devices on one day.

The exposed surface largely comprises firewall appliances and VPN gateways deployed to secure remote access, highlighting a broad attack surface across multiple sectors and geographies. Shadowserver began tracking and sharing live daily data on compromised IPs associated with CVE-2025-9242, using active scanning to identify vulnerable WatchGuard Fireware OS systems visible on the Internet.

Experts urge IT teams to patch affected systems and verify that no unauthorized access has occurred, as the incident underlines the need for ongoing vulnerability management and proactive security monitoring.