WatchGuard security advisories, August 2026

Every WatchGuard security advisory published in August 2026, from WatchGuard PSIRT Advisories via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 29
Critical: 7
High: 10
In CISA KEV: 0
CVEs: 29

WatchGuard advisories published in August 2026

Aug 27, 2026
Critical [CVE-2026-78174] WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log
Critical9.3
Aug 27, 2026
Critical [CVE-2026-19315] type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
Critical9.3
Aug 27, 2026
Critical [CVE-2026-13086] stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code
Critical9.3
Aug 27, 2026
Critical [CVE-2026-19313] heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
Critical9.3
Aug 27, 2026
Critical [CVE-2026-19318] stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
Critical9.3
Aug 27, 2026
High [CVE-2026-78612] WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests
High8.6
Aug 27, 2026
High [CVE-2026-78613] WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests
High8.6
Aug 27, 2026
High [CVE-2026-78610] WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection
High8.4
Aug 27, 2026
High [CVE-2026-13108] WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service
High8.7
Aug 27, 2026
High [CVE-2026-78614] WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests
High8.6
Aug 27, 2026
High [CVE-2026-19314] integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic
High8.7
Aug 27, 2026
High [CVE-2026-19317] out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic
High8.7
Aug 27, 2026
High [CVE-2026-78010] stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic
High8.7
Aug 27, 2026
High [CVE-2026-19316] double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic
High8.7
Aug 27, 2026
High [CVE-2026-78008] buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic
High8.6
Aug 27, 2026
Medium [CVE-2026-78616] Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate
Medium4.8
Aug 27, 2026
Medium [CVE-2026-78498] server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems
Medium5.1
Aug 27, 2026
Medium [CVE-2026-78195] Cross-Site Scripting (XSS) vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser
Medium5.1
Aug 27, 2026
Medium [CVE-2026-78103] WatchGuard Dimension provides a client-side lock/unlock UI control for management changes
Medium5.1
Aug 27, 2026
Medium [CVE-2026-78615] Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL
Medium4.6
Aug 27, 2026
Medium [CVE-2026-78495] server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems
Medium5.3
Aug 27, 2026
Medium [CVE-2026-78617] WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts
Medium6.3
Aug 27, 2026
Medium [CVE-2026-78047] stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user
Medium5.1
Aug 27, 2026
Medium [CVE-2026-78499] server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems
Medium5.1
Aug 27, 2026
Medium [CVE-2026-78618] business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request
Medium6.9
Aug 27, 2026
Medium [CVE-2026-78500] blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems
Medium5.1
Aug 27, 2026
Medium [CVE-2026-81851] Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service
Medium6.9
Aug 25, 2026
Critical [CVE-2026-57910] Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges
Critical9.3
Aug 25, 2026
Critical [CVE-2026-57909] path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system
Critical9.4

Get an email when WatchGuard publishes the next one.

See WatchGuard's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about WatchGuard

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.