WatchGuard Patches Five Critical Flaws That Could Let Attackers Seize Control Remotely
Security appliance maker WatchGuard has fixed more than two dozen vulnerabilities in its firewall software and management tools, including five rated near-perfect in severity.
Key points
- WatchGuard patched 26-plus vulnerabilities across Fireware OS and WatchGuard Dimension, including five rated 9.3 out of 10 in severity.
- Three critical flaws in Fireware OS versions before 2026.2.2, 12.12.2, and 12.5.20 could let an outside attacker run malicious code on a device without needing a password.
- A fifth critical bug in WatchGuard Dimension versions before 2.3.1 could let a low-level admin steal a super-administrator's active login and take over the account.
- WatchGuard says none of the vulnerabilities have been exploited in the wild as of the patch release date.
WatchGuard, which makes network security devices used by businesses to control internet traffic and connect remote workers, has pushed out fixes for more than two dozen software vulnerabilities. Five carry a severity score of 9.3 out of 10, placing them in the critical tier.
How bad are the critical flaws?
Three of the five require no login to exploit. An attacker anywhere on the internet could send specially crafted network traffic to a vulnerable device and gain full remote code execution, meaning they could run any software they like on the machine.
All three sit inside a part of the Fireware OS called the iked process. That is the component responsible for negotiating the encrypted tunnels used by VPNs, the virtual private networks that let employees connect securely from outside the office. The specific flaws are:
| CVE ID | Flaw type | What it allows |
|---|---|---|
| CVE-2026-19313 | Heap buffer overflow (memory error that lets attackers write data outside a program's reserved space) | Remote code execution |
| CVE-2026-19318 | Stack-based buffer overflow (similar memory error on a different part of the program's workspace) | Remote code execution |
| CVE-2026-19315 | Type confusion (the software misreads data it receives, opening a path to manipulation) | Remote code execution |
A fourth critical flaw, CVE-2026-13086, is a similar memory error in the Endpoint Protection Manager service tied to a now-retired Mobile Security feature. It too allows remote code execution.
What about the account takeover bug?
The fifth critical vulnerability, CVE-2026-78174, works differently. It sits in WatchGuard Dimension, a logging and visibility platform that organisations use to monitor their network devices. A low-privileged administrator, someone with limited access, could exploit it to pull out a super-administrator's active session ID and a security token called a CSRF token, which normally prevents unauthorised actions. With those two items, the attacker could take over the super-admin account entirely.
Beyond the five critical issues, the patch batch also closes seven high-severity bugs that could crash devices, five high-severity Dimension flaws covering command execution and admin password tampering, and 11 medium-severity issues.
What should organisations do right now?
Update immediately. Fixed versions are Fireware OS 2026.2.2, 12.12.2, and 12.5.20, and Dimension version 2.3.1. WatchGuard has confirmed no exploitation in the wild so far, but unauthenticated remote code execution flaws attract attention quickly once public details emerge.
Businesses running WatchGuard appliances should also check that the management interface for Dimension is not exposed directly to the internet, since account-takeover bugs are far easier to exploit when an attacker can reach the login page without stepping inside the network first. SecurityWeek first reported the full vulnerability count.
