WatchGuard vulnerabilities
We track 97 vulnerabilities in WatchGuard products across 21 products. 97 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest WatchGuard vulnerabilities
- 8.5 High severity
Endpoint Security: Improper Privilege Management
A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting
- 9.1 Critical severity
AuthPoint Authentication Gateway: Authentication Bypass by Capture-replay
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disru
- 9.2 Critical severity
AuthPoint Authentication Gateway: Unchecked Return Value
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchroniz
- 9.1 Critical severity
AuthPoint Authentication Gateway: Improper Certificate Validation
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
- 8.9 High severity
AuthPoint Authentication Gateway: Insufficient Verification of Data Authenticity
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body,
- 9.2 Critical severity
Fireware OS: Integer Overflow or Wraparound
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access
- 9.2 Critical severity
Fireware OS: Improper Neutralization of Special Elements used in a Command
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management
- 7.1 High severity
Fireware OS: Improper Limitation of a Pathname to a Restricted Directory
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a
- 7.2 High severity
Fireware OS: Out-of-bounds Read
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization proc
- 9.2 Critical severity
Fireware OS: Buffer Copy without Checking Size of Input
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
- 8.7 High severity
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows…
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
- 9.4 Critical severity
Fireware OS: Improper Neutralization of Special Elements used in a Command
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by
- 7.2 High severity
Fireware OS: Improper Link Resolution Before File Access
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrit
- 8.6 High severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specia
- 9.2 Critical severity
Fireware OS: Heap-based Buffer Overflow
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrar
- 9.2 Critical severity
Fireware OS: Heap-based Buffer Overflow
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code
- 8.7 High severity
Fireware OS: Uncaught Exception
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Re
- 9.5 Critical severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potent
- 7.1 High severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially cra
- 7.3 High severity
WatchGuard Agent: Incorrect Default Permissions
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows a
- 8.8 High severity
Endpoint Security: Missing Authentication for Critical Functionality
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to t
- 7.5 High severity
Fireware OS: NULL Pointer Dereference
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.
- 8.1 High severity
Fireware OS: Exposure of Sensitive Information to an Unauthorized Actor
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files a
- 8.1 High severity
Fireware OS: Improper Limitation of a Pathname to a Restricted Directory
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files a
- 7.5 High severity
Fireware OS: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of
- 7.5 High severity
Fireware OS: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
- 9.8 Critical severity
Fireware OS: Improper Control of Generation of Code
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
- 7.5 High severity
Fireware OS: NULL Pointer Dereference
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
- 7.1 High severity
Fireware OS: Improper Limitation of a Pathname to a Restricted Directory
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different
- 7.5 High severity
Fireware OS: Uncontrolled Resource Consumption
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
- 8.7 High severity
Fireware OS: Buffer Copy without Checking Size of Input
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP pack
- 7.2 High severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted ma
- 7.2 High severity
Fireware OS: Deserialization of Untrusted Data
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the s
- 8.6 High severity
WatchGuard AP: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
- 9.3 Critical severity
WatchGuard AP: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
- 9.3 Critical severity
WatchGuard AP: Improper Access Control
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
- 7.5 High severity
AuthPoint Authentication Gateway: Improper Authentication
A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication
- 7.0 High severity
Dimension: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web p
- 8.6 High severity
Dimension: Improper Neutralization of Special Elements used in an SQL Command
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending spe
- 8.6 High severity
Dimension: Improper Neutralization of Special Elements used in an SQL Command
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending speci