WatchGuard security advisories, July 2026

WatchGuard advisories published in July 2026

1. Jul 3, 2026
   Critical [CVE-2026-13368] WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2

   Critical9.2

2. Jul 3, 2026
   High [CVE-2026-8247] Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code

   High7.7

3. Jul 3, 2026
   High [CVE-2026-13722] WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature

   High8.6

4. Jul 3, 2026
   High [CVE-2026-13384] Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI

   High8.6

5. Jul 3, 2026
   High [CVE-2026-13383] Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI

   High8.6

6. Jul 3, 2026
   High [CVE-2026-13084] null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages

   High8.7

7. Jul 3, 2026
   High [CVE-2026-13079] local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed

   High7.3

8. Jul 3, 2026
   High [CVE-2026-13054] path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem

   High8.6

9. Jul 3, 2026
   High [CVE-2026-13053] Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command

   High8.6

10. Jul 3, 2026
    High [CVE-2026-13050] Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI

    High8.6

11. Jul 3, 2026
    Medium [CVE-2026-13728] In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources

    Medium5.9

12. Jul 3, 2026
    Medium [CVE-2025-6947 +1] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS

    Medium4.8

13. Jul 3, 2026
    Medium [CVE-2025-1071 +1] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS

    Medium4.8

14. Jul 3, 2026
    Medium [CVE-2025-13938 +1] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS

    Medium4.8

15. Jul 3, 2026
    Medium [CVE-2025-13937 +1] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS

    Medium4.8

16. Jul 3, 2026
    Medium [CVE-2025-13936 +1] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS

    Medium4.8

17. Jul 2, 2026
    Medium [CVE-2026-13371] WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization

    Medium6.9