{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: WatchGuard vulnerabilities","home_page_url":"https://patchfirst.co/vendor/watchguard/","feed_url":"https://patchfirst.co/feed/vendor/watchguard.json","description":"New and newly exploited WatchGuard CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-93857","url":"https://patchfirst.co/cve/CVE-2026-93857/","title":"CVE-2026-93857: A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.5% (higher than 40.8% of CVEs). CVSS 9.2 CRITICAL. Priority 16.0 of 100.","summary":"A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-29T11:17:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.00471,"percentile":0.40776},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93865","url":"https://patchfirst.co/cve/CVE-2026-93865/","title":"CVE-2026-93865: A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.5% (higher than 40.1% of CVEs). CVSS 9.2 CRITICAL. Priority 15.8 of 100.","summary":"A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-29T11:17:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00463,"percentile":0.40142},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-93866","url":"https://patchfirst.co/cve/CVE-2026-93866/","title":"CVE-2026-93866: An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.4% (higher than 39% of CVEs). CVSS 9.2 CRITICAL. Priority 15.6 of 100.","summary":"An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.6,"kev":null,"epss":{"score":0.00448,"percentile":0.38995},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103594","url":"https://patchfirst.co/cve/CVE-2026-103594/","title":"CVE-2026-103594: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.4% (higher than 37.5% of CVEs). CVSS 9.5 CRITICAL. Priority 15.2 of 100.","summary":"A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.00432,"percentile":0.37527},"cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-112710","url":"https://patchfirst.co/cve/CVE-2026-112710/","title":"CVE-2026-112710: A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.2 CRITICAL. Priority 14.8 of 100.","summary":"A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36246},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-112709","url":"https://patchfirst.co/cve/CVE-2026-112709/","title":"CVE-2026-112709: A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.2 CRITICAL. Priority 14.8 of 100.","summary":"A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:39:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36246},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-90465","url":"https://patchfirst.co/cve/CVE-2026-90465/","title":"CVE-2026-90465: A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster…","content_text":"WatchGuard · Fireware OS. Not in CISA KEV. EPSS 0.2% (higher than 14.8% of CVEs). CVSS 9.4 CRITICAL. Priority 10.9 of 100.","summary":"A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-29T11:17:37.000Z","tags":[],"_patchfirst":{"reason":"published","priority":10.9,"kev":null,"epss":{"score":0.00237,"percentile":0.14753},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"vendor":"WatchGuard","product":"Fireware OS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-14733#kev","url":"https://patchfirst.co/cve/CVE-2025-14733/","title":"[KEV] CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability","content_text":"WatchGuard · Firebox. In CISA KEV since 2025-12-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 29.4% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.","summary":"WatchGuard Firebox Out of Bounds Write Vulnerability","date_published":"2025-12-19T00:00:00.000Z","date_modified":"2026-09-09T04:17:52.000Z","tags":["kev","ransomware","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2025-12-19","ransomware":true},"epss":{"score":0.29423,"percentile":0.98178},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WatchGuard","product":"Firebox","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-9242#kev","url":"https://patchfirst.co/cve/CVE-2025-9242/","title":"[KEV] CVE-2025-9242: WatchGuard Firebox Out-of-Bounds Write Vulnerability","content_text":"WatchGuard · Firebox. In CISA KEV since 2025-11-12. ENISA EUVD lists it as exploited. EPSS 92.2% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"WatchGuard Firebox Out-of-Bounds Write Vulnerability","date_published":"2025-11-12T00:00:00.000Z","date_modified":"2026-08-10T19:59:12.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2025-11-12","ransomware":false},"epss":{"score":0.92219,"percentile":0.99822},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WatchGuard","product":"Firebox","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-23176#kev","url":"https://patchfirst.co/cve/CVE-2022-23176/","title":"[KEV] CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability","content_text":"WatchGuard · Firebox and XTM. In CISA KEV since 2022-04-11. ENISA EUVD lists it as exploited. EPSS 10.8% (higher than 95.8% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1133 External Remote Services; T1078 Valid Accounts. Priority 63.3 of 100.","summary":"WatchGuard Firebox and XTM Privilege Escalation Vulnerability","date_published":"2022-04-11T00:00:00.000Z","date_modified":"2026-06-17T04:29:37.000Z","tags":["kev","T1133","T1078"],"_patchfirst":{"reason":"kev","priority":63.3,"kev":{"dateAdded":"2022-04-11","ransomware":false},"epss":{"score":0.10805,"percentile":0.95838},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"WatchGuard","product":"Firebox and XTM","techniqueIds":["T1133","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26318#kev","url":"https://patchfirst.co/cve/CVE-2022-26318/","title":"[KEV] CVE-2022-26318: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution","content_text":"WatchGuard · Firebox and XTM Appliances. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"WatchGuard Firebox and XTM Appliances Arbitrary Code Execution","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T04:34:58.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.78157,"percentile":0.99577},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WatchGuard","product":"Firebox and XTM Appliances","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}