CVE-2026-13373: WatchGuard Fireware Stored XSS in Tigerpaw Module

Technical summary

CVE-2026-13373 is a CWE-79 improper input neutralization flaw enabling stored XSS in Fireware OS. The vulnerability exists in the Tigerpaw Technology Integration module and allows authenticated administrators to inject unsanitized input that persists in the application's data store. When other authorized users access pages containing the injected payload, the malicious script executes in their browser context with the privileges of the authenticated session. This represents an unpatched secondary attack vector to the previously disclosed CVE-2025-13936.

Business impact

This vulnerability poses a insider threat risk, particularly in multi-administrator environments. A rogue or compromised high-privilege account can inject persistent payloads that steal session cookies, redirect users to malicious sites, or harvest credentials from subsequent administrators. The broad appliance coverage means organizations running any recent WatchGuard Firebox model could be affected, making this a supply-chain consideration for managed security service providers and enterprises with distributed firewall deployments.

Affected systems

The vulnerability affects Fireware OS across the entire current Firebox lineup: M-series appliances (M270, M290, M295, M370, M390, M395, M440, M470, M495, M4600, M4800, M570, M590, M595, M670, M690, M695, M5600, M5800), T-series appliances (T15, T20, T25, T35, T40, T45, T55, T70, T80, T85, T115-W, T125, T125-W, T145, T145-W, T185), NV5, FireboxCloud, and FireboxV. Any deployment with the Tigerpaw Technology Integration module enabled is potentially at risk.

Exploitability

The CVSS 3.1 score of 4.8 (MEDIUM) reflects the attack's practical limitations: exploitability requires high privilege (PR:H), user interaction (UI:R), and a cross-site context (S:C). While not remotely exploitable by unauthenticated users, the attack is straightforward to execute for administrators with legitimate console access. It is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting limited public weaponization to date. However, the low technical bar and high persistence make it attractive for insider threat scenarios.

Remediation

Organizations should verify the availability of patched Fireware OS versions from WatchGuard security advisories and apply updates to all affected appliances. Until patches are available, restrict administrative console access using network segmentation and role-based access controls, monitor admin activity logs for suspicious input submissions, and disable the Tigerpaw Technology Integration module if operationally feasible. Consider implementing Content Security Policy headers at upstream proxy layers if applicable.

Patch guidance

Consult WatchGuard's official security advisories and release notes to identify the patched Fireware OS version that addresses CVE-2026-13373. Patches are typically released through Fireware OS firmware updates. Test patches in a staging environment before production deployment, as appliance firmware updates may require brief service interruptions. Prioritize patching in environments where multiple administrators share console access or where third-party integrations depend on Tigerpaw modules.

Detection guidance

Monitor Fireware OS audit and admin access logs for unexpected input submissions to configuration fields, particularly those consumed by the Tigerpaw module. Search for HTML-like or script-like patterns in admin activity logs and configuration exports. Implement browser-based detection for injected scripts using security headers (X-Content-Type-Options, Content-Security-Policy) and browser console monitoring in the admin portal. Network-based detection is limited due to the stored nature of the payload; detection occurs when administrators interact with poisoned pages.

Why prioritize this

Despite the MEDIUM CVSS score, this vulnerability warrants prioritization for organizations with shared Firebox admin environments or high-trust insider concerns. The stored nature means it requires only one successful injection to compromise multiple administrators over time. Its status as a secondary vector to CVE-2025-13936 suggests incomplete vendor remediation. Organizations should patch in line with their insider threat risk tolerance and administrative team size.

Risk score, explained

The CVSS score of 4.8 reflects the requirement for high privilege, user interaction, and limited confidentiality/integrity impact (C:L, I:L). The score does not escalate to High despite broad product coverage because the attack requires legitimate admin credentials and user-driven payload detonation, substantially reducing the threat surface. However, the cross-site scope (S:C) and persistence of stored XSS elevate it above Low risk for multi-user deployments.

Frequently asked questions