Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 205

Export CSV
CVE-2026-90465

Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-103593

Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-93862

Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Os
CVE-2026-96293

Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Watchguard Agent
CVE-2026-115253

WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering

An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Watchguard Agent
CVE-2026-13043

WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft Watchguard
Products
Windows Endpoint Security
CVE-2026-13046

Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-13224

Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-18105

Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-18145

Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86101

Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-95676

AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Authentication Gateway Authpoint Authentication Gateway
CVE-2026-86104

Fireware OS Resource Exhaustion in Login Process Allows Denial of Service

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86105

Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86128

Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86132

Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86133

Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-86136

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os
CVE-2026-90441

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Fireware Fireware Os