CVE-2026-13053: WatchGuard Fireware CLI Out-of-Bounds Write Vulnerability (CVSS 7.2)

Technical summary

CVE-2026-13053 is an out-of-bounds write vulnerability (CWE-787) in WatchGuard Fireware OS's CLI implementation. The vulnerability permits an authenticated privileged user to execute arbitrary code via a crafted CLI command. With a CVSS 3.1 score of 7.2 (HIGH), the attack vector is network-based, requires no user interaction, and demands high privilege level (PR:H). Successful exploitation results in confidentiality, integrity, and availability compromise of the affected system. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the published date.

Business impact

An attacker with administrator credentials could fully compromise a WatchGuard firewall's security posture. This includes exfiltrating sensitive network traffic logs, modifying firewall rules to permit unauthorized access, installing persistence mechanisms, or disrupting availability. Organizations relying on these firewalls for perimeter defense face elevated risk of data breach, lateral movement into internal networks, and potential regulatory non-compliance if intrusions occur due to unpatched systems.

Affected systems

The vulnerability impacts a broad range of WatchGuard Fireware devices across multiple product lines: the Firebox M-Series (M270, M290, M295, M370, M390, M395, M440, M470, M495, M4600, M4800, M5600, M570, M5800, M590, M595, M670, M690, M695), Firebox T-Series (T15, T20, T25, T35, T40, T45, T55, T70, T80, T85, T115-W, T125, T125-W, T145, T145-W, T185), Firebox NV5, FireboxCloud, and FireboxV. Any organization using WatchGuard Fireware OS across these platforms should assess their environment immediately.

Exploitability

Exploitation requires valid administrative credentials and direct or proxied network access to the CLI interface. The barrier to weaponization is moderate: while the attack vector is network-accessible, the privilege requirement (authenticated admin user) limits opportunistic exploitation. However, this is a significant threat in scenarios where admin accounts are compromised, shared, or used by insider threats. No public exploit code or active exploitation has been documented as of the publication date, but the straightforward nature of CLI command injection makes rapid exploitation likely once details emerge.

Remediation

Organizations must apply vendor-supplied patches to all affected WatchGuard Fireware devices as soon as available. Verify patch versions and compatibility with your deployment architecture through WatchGuard's security advisory. In parallel, implement immediate compensating controls: enforce strict CLI access restrictions to trusted administrative sources only, require multi-factor authentication for administrative access, and monitor CLI command logs for suspicious activity patterns.

Patch guidance

Contact WatchGuard support or visit the official security advisory to obtain the corrected Fireware OS version for your specific Firebox model. Patch deployment should follow your change management process, with testing in a non-production environment first. Prioritize internet-facing or critical infrastructure firewalls. Verify the patch status on all instances, including any FireboxCloud or virtual deployments (FireboxV) that may be overlooked in inventory scans.

Detection guidance

Enable and monitor CLI audit logging on all WatchGuard devices. Look for CLI commands that include unusual syntax, buffer-like payloads, or commands originating from unexpected administrative accounts or IP addresses. Network-level detection should focus on anomalous authentication patterns to the firewall's management interface. Additionally, monitor system logs for evidence of process creation, memory corruption errors, or unexpected service restarts that could indicate exploitation attempts. Implement inline intrusion detection rules if available for CLI-based out-of-bounds write patterns.

Why prioritize this

A HIGH-severity vulnerability affecting dozens of firewall models across a widely-deployed security platform warrants immediate priority. The attack requires only compromised admin credentials—a realistic threat given widespread credential theft campaigns—and provides complete system compromise. The broad affected product range means most WatchGuard deployments need patching. Although not yet in KEV, the public disclosure and technical clarity will likely accelerate exploitation within weeks.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects HIGH severity because: (1) the network attack vector permits remote exploitation, (2) while requiring high privilege (authenticated admin), privilege escalation within a firewall environment is potent, (3) successful exploitation delivers complete confidentiality, integrity, and availability impact, and (4) the lack of user interaction requirement means automated attacks are feasible. The score appropriately weights the barrier of administrative access against the total system compromise outcome.

Frequently asked questions