watchguard has 66 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 43 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 21. The median CVSS is 7.5 (high), with 16 rated critical. 3% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-787 (10) and CWE-121 (8). Most affected products: fireware (33), Fireware OS (19), WatchGuard AP (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 3% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —(2)
- Last 90 days
- 43 prev 0
Weakness classes
Products
- fireware 33
- Fireware OS 19
- WatchGuard AP 3
- WatchGuard Agent 3
- authentication_gateway 3
- Dimension 1
Worst active — by depth score
CVE-2025-9242Critical· 9.8An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code97CVE-2025-14733Critical· 9.8An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code90CVE-2024-6592Critical· 9.1An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker w…62CVE-2026-13043High· 8.8A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary p…60CVE-2026-86131Critical· 9.8A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.54
watchguard vulnerabilities
CVEs affecting watchguard, newest first. Open any entry for full detail, references, and exploit status.
66 CVEsRSS
CVE-2026-115495Medium· 5.7Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.
CVE-2026-90465High· 8.7Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall managem…
CVE-2026-93862High· 7.2Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's clust…
CVE-2026-90464High· 7.2Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create…
CVE-2026-113881Medium· 6.1Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged…
CVE-2026-112709Critical· 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially …
CVE-2026-82332Medium· 5.6Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a …
CVE-2026-103593Critical· 9.1Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by pre…
CVE-2026-90442High· 8.6Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service
A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary c…
CVE-2026-93434High· 8.7Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a special…
CVE-2026-112710Critical· 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and poten…
CVE-2026-93866Critical· 9.2Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted re…
CVE-2026-93857Critical· 9.2Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
CVE-2026-103594Critical· 9.5Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Servi…
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP s…
CVE-2026-111107High· 8.7Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially cr…
CVE-2026-104381Medium· 6.0Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by s…
CVE-2026-93865Critical· 9.2Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the…
CVE-2026-96293Medium· 6.9Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery K…
CVE-2026-115253High· 7.3WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the d…
CVE-2026-13043High· 8.8PoCA missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary p…
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary p…
CVE-2026-86134High· 7.5A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a …
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a …
CVE-2026-81433High· 8.7A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a spec…
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a spec…
CVE-2026-86136High· 8.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and…
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and…
CVE-2026-86128High· 7.5A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
CVE-2026-86101Medium· 6.5An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially c…
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially c…
CVE-2026-86132High· 7.5An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher …
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher …
CVE-2026-18145High· 7.2A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending…
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending…
CVE-2026-86105High· 7.1An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted r…
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted r…
CVE-2026-86104High· 7.5An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.