WatchGuard vulnerabilities
We track 97 vulnerabilities in WatchGuard products across 21 products. 97 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest WatchGuard vulnerabilities
- 8.6 High severity
Dimension: Improper Neutralization of Special Elements used in an SQL Command
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending
- 8.4 High severity
Dimension: Cross-Site Request Forgery
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to
- 9.3 Critical severity
Dimension: Exposure of Sensitive Information to an Unauthorized Actor
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in
- 8.7 High severity
Fireware OS: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 8.7 High severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 8.7 High severity
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote…
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 8.6 High severity
Fireware OS: Out-of-bounds Write
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network tr
- 9.3 Critical severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- 8.7 High severity
Fireware OS: Out-of-bounds Read
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 8.7 High severity
Fireware OS: Double Free
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 9.3 Critical severity
Fireware OS: Out-of-bounds Read
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- 8.7 High severity
Fireware OS: Integer Underflow (Wrap or Wraparound)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- 9.3 Critical severity
Fireware OS: Heap-based Buffer Overflow
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- 8.7 High severity
Dimension: Uncontrolled Resource Consumption
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.
- 9.3 Critical severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
- 9.3 Critical severity
WatchGuard Agent: Missing Authentication for Critical Functionality
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
- 9.4 Critical severity
WatchGuard Agent: Improper Control of Generation of Code
A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.
- 8.8 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and in
- 7.2 High severity
Fireware OS: Improper Verification of Cryptographic Signature
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
- 8.1 High severity
Fireware OS: Use After Free
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of
- 7.5 High severity
Fireware OS: NULL Pointer Dereference
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with I
- 7.8 High severity
Mobile VPN with SSL Client: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with
- 7.2 High severity
Fireware OS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
- 7.8 High severity
WatchGuard Agent: Incorrect Permission Assignment for Critical Resource
Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.
- 7.2 High severity
Fireware OS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and includ
- 7.0 High severity
Fireware OS: Improper Neutralization of Special Elements used in an LDAP Query
An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerabilit
- 9.8 Critical severity
WatchGuard Firebox Out of Bounds Write Exploited
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when con
- 7.2 High severity
Fireware OS: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.
- 7.5 High severity
Fireware OS: XML Injection
An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affec
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.
- 7.2 High severity
Fireware OS: Out-of-bounds Write
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.
- 7.5 High severity
Fireware OS: Release of Invalid Pointer or Reference
A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer
- 8.9 High severity
Fireware OS: Active Debug Code
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.
- 9.8 Critical severity
WatchGuard Firebox Out-of-Bounds Write Exploited
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when con