CVE-2026-13384: WatchGuard Fireware wgagent Out-of-Bounds Write RCE Vulnerability

Technical summary

CVE-2026-13384 is an out-of-bounds write vulnerability (CWE-787) in the wgagent daemon running on WatchGuard Fireware OS. The vulnerability is reachable via authenticated HTTP requests to the Management Web UI and requires high privilege (admin) context to exploit. The out-of-bounds write condition can be triggered through maliciously crafted input, leading to memory corruption that permits arbitrary code execution with the privileges of the wgagent process. The CVSS v3.1 score of 7.2 (HIGH) reflects high impact on confidentiality, integrity, and availability, offset by the requirement for privileged authentication and network-only attack vector.

Business impact

Compromise of WatchGuard firewalls via this vulnerability would allow an attacker to execute arbitrary commands on network perimeter devices. The impact includes potential exfiltration of network traffic, modification of firewall rules to permit lateral movement, denial of service, and use of the firewall as a pivot point to attack internal systems. For organizations relying on WatchGuard products for core network segmentation and defense, exploitation could result in breach of critical assets, regulatory compliance violations, and extended remediation costs. The broad product range affected (40+ models from M-series, T-series, and cloud variants) means this impacts enterprise deployments across multiple size classes.

Affected systems

The vulnerability affects a comprehensive range of WatchGuard Fireware platforms: all M-series models (M270 through M5800), all T-series models (T15 through T185, including wireless variants T115-W, T125-W, T145-W), cloud-based variants (FireboxCloud and FireboxV), and the NV5 appliance. Any deployment running the vulnerable Fireware OS versions on these hardware platforms is at risk. Organizations should audit their WatchGuard inventory to identify affected models and Fireware versions currently in production.

Exploitability

Exploitation requires authenticated administrative access to the firewall's Management Web UI. This prerequisite substantially limits the attack surface compared to unauthenticated flaws—the attacker must already possess valid admin credentials, either through phishing, credential compromise, insider threat, or prior network access. However, admin credentials for network appliances are sometimes shared across teams or stored in configuration management systems, increasing the likelihood of compromise. Once credentials are obtained, triggering the vulnerability requires only a network-reachable Management Web UI and no end-user interaction. The CISA KEV catalog has not included this vulnerability as of the last update, suggesting active exploitation has not been widely observed or reported in the wild.

Remediation

Organizations must apply a patched Fireware OS version from WatchGuard that addresses CWE-787 in the wgagent process. Contact WatchGuard support or consult their security advisories to identify the specific Fireware version that resolves this issue for each affected model. Until patching is completed, implement strict access controls: restrict Management Web UI access to trusted administrator IP addresses via firewall rules, enforce multi-factor authentication for admin accounts, monitor admin authentication logs for suspicious access patterns, and consider disabling remote management if not operationally necessary. Rotate admin credentials on all affected appliances to limit lateral impact from any prior compromise.

Patch guidance

Verify the current Fireware OS version on each affected WatchGuard appliance and consult WatchGuard's official security bulletin to obtain the patched version applicable to your hardware model. Fireware updates typically require a brief system reboot. Test patches in a non-production environment if possible, though the critical nature of this vulnerability makes timely patching a priority. After applying patches, verify that the wgagent process restarts cleanly and that Management Web UI connectivity is restored. Maintain records of patch deployment dates and confirmation for compliance and audit purposes.

Detection guidance

Monitor firewall logs and the Management Web UI access logs for unusual administrative activity, particularly failed authentication attempts or unusual request patterns to admin endpoints. If available, enable detailed process-level logging for the wgagent daemon and review for unexpected behavior. Organizations with network behavior analytics or intrusion detection capability should flag requests to the Management Web UI that contain binary payloads or exceed normal request sizes, as these may indicate exploitation attempts. Correlation of Management Web UI access logs with system resource spikes (CPU, memory) or unexpected process spawning events could indicate active exploitation. Additionally, monitor for any unexpected firewall rule changes or policy modifications that could indicate post-compromise lateral movement.

Why prioritize this

This vulnerability merits high priority patching because it affects a foundational security appliance across a broad product range, requires only privileged access (which is achievable through credential theft), and results in complete code execution. Firewall compromise directly enables network-level attacks and evasion of downstream security controls. The lack of exploitation in the wild provides a narrow window to patch before threat actors leverage this for targeted attacks. Organizations should prioritize patching based on: (1) firewalls exposed to untrusted networks, (2) firewalls protecting critical assets, (3) deployments where admin credential controls are weaker, and (4) firewalls where Management Web UI is internet-accessible.

Risk score, explained

The CVSS 7.2 HIGH score reflects: (1) network-accessible attack vector and low attack complexity (no special conditions needed beyond crafted input), (2) high impact across all three security properties (confidentiality, integrity, availability), but (3) tempered by the requirement for high privilege (authenticated admin) context. The score correctly identifies this as serious but not critical, since exploitation requires prior credential compromise. In practice, organizational risk varies significantly: deployments with strong admin credential controls and restricted Management Web UI access face lower risk than those with shared credentials or internet-exposed management interfaces.

Frequently asked questions