CyberSIXT Search
Vendor

WatchGuard

No CISA KEV deadline is open. CISA last added a WatchGuard CVE on 19 Dec 2025.

Tracked since 5 Feb · latest article Wed 30 Sep · RSS

Added to KEV · 90 days
0
of 4 in the full CISA catalogue · all time
High exploit odds · current
0
EPSS top 5%, not in KEV
Articles · 7 days
0
none this week

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2025-14733not in CyberSIXT coverageFirebox19 Dec 2025Deadline passed 26 Dec 2025Known ransomware use
CVE-2025-9242not in CyberSIXT coverageFirebox12 Nov 2025Deadline passed 3 Dec 2025
CVE-2022-23176not in CyberSIXT coverageFirebox and XTM11 Apr 2022Deadline passed 2 May 2022
CVE-2022-26318not in CyberSIXT coverageFirebox and XTM Appliances25 Mar 2022Deadline passed 15 Apr 2022

Products

6 products · 9 CVEs in coverage
Firebox0 CVEs · 2 in KEVFirebox and XTM0 CVEs · 1 in KEVFirebox and XTM Appliances0 CVEs · 1 in KEVFireware OS4 CVEs · 0 in KEVlatest 30 SepAP3 CVEs · 0 in KEVlatest 30 Sep
1 more productsAgent2 CVEs · 0 in KEVlatest 26 Aug

Coverage

7 articles · all timeFull timeline

7 articles from 3 outlets since 5 Feb; the latest 26 days ago.

WatchGuard: coverage over time7 articles from 3 outlets. First report 5 Feb by SecurityOnline. Busiest week: 4 articles, week of 28 Sep. 0 in the last 7 days. WatchGuard: coverage over time7 articles from 3 outlets. First report 5 Feb by SecurityOnline. Busiest week: 4 articles, week of 28 Sep. 0 in the last 7 days.
  • Article
  • First report
Show as table
WatchGuard: articles
Published (UTC)OutletHeadline
Wed 30 Sep · 20:24 UTCSecurity AffairsWatchGuard Patches Firebox Flaw That Grants Attackers Root Access
Wed 30 Sep · 13:51 UTCSecurityWeekWatchGuard Patches Critical Firebox Flaw Enabling Root RCE
Wed 30 Sep · 03:01 UTCSecurityOnlineWatchGuard Patches Firebox Flaws Enabling Unauthenticated Remote Code Execution
Tue 29 Sep · 02:28 UTCSecurityOnlineWatchGuard Access Points Expose Networks to Critical Command Injection
Wed 26 Aug · 04:09 UTCSecurityOnlineWatchGuard Fixes Critical RCE Flaws in Windows Agent
Fri 3 Jul · 02:41 UTCSecurityOnlineWatchGuard patches critical Firebox RCE flaw CVE-2026-13368
Thu 5 Feb · 01:55 UTCSecurityOnlineWatchGuard Patches VPN PrivEsc & Firebox LDAP Injection

Who reported 3 outlets, last 12 months

  • SecurityOnline5
  • SecurityWeek1
  • Security Affairs1
  1. WatchGuard Patches Firebox Flaw That Grants Attackers Root AccessSecurity Affairs
  2. WatchGuard Patches Critical Firebox Flaw Enabling Root RCESecurityWeek
  3. WatchGuard Patches Firebox Flaws Enabling Unauthenticated Remote Code ExecutionSecurityOnline
  4. WatchGuard Access Points Expose Networks to Critical Command InjectionSecurityOnline
  5. WatchGuard Fixes Critical RCE Flaws in Windows AgentSecurityOnline
  6. WatchGuard patches critical Firebox RCE flaw CVE-2026-13368SecurityOnline
  7. WatchGuard Patches VPN PrivEsc & Firebox LDAP InjectionSecurityOnline

All CVEs in coverage

9
CVE-2026-86102WatchGuard AP Command Injection in Internal Management API Allows Command ExecutionCVSS9.3Critical–Not in KEV2.3%EPSS2articles
CVE-2026-87969WatchGuard AP Authenticated Command Injection in Diagnostic CLICVSS8.6High–Not in KEV1.2%EPSS1article
CVE-2026-13368WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationCVSS9.2Critical–Not in KEV0.9%EPSS1article
CVE-2026-1498WatchGuard Firebox LDAP InjectionCVSSUnrated–Not in KEV0.9%EPSS1article
CVE-2026-86131Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code ExecutionCVSS9.2Critical–Not in KEV0.5%EPSS3articles
CVE-2026-57909WatchGuard Agent path traversal allows unauthenticated remote code executionCVSS9.4Critical–Not in KEV0.4%EPSS1article
CVE-2026-101891WatchGuard AP Improper Access Control in API Service Allows Unauthenticated AccessCVSS9.3Critical–Not in KEV0.3%EPSS2articles
CVE-2026-57910WatchGuard Agent improper authentication allows unauthenticated remote code executionCVSS9.3Critical–Not in KEV0.3%EPSS1article
CVE-2026-81433Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code ExecutionCVSS8.7High–Not in KEV0.2%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device