WatchGuard Patches Five Critical Flaws That Could Let Attackers Seize Control Remotely
WatchGuard has fixed more than two dozen vulnerabilities in its firewall software and management tools, including five rated 9.3 out of 10 in severity.
Key points
- WatchGuard patched 26-plus vulnerabilities across Fireware OS and WatchGuard Dimension, including five rated 9.3 out of 10 in severity.
- Three critical flaws in Fireware OS versions before 2026.2.2, 12.12.2, and 12.5.20 could let an outside attacker run malicious code on a device without needing a password.
- A fifth critical bug in WatchGuard Dimension versions before 2.3.1 could let a low-level admin steal a super-administrator's active login and take over the account.
- WatchGuard says none of the vulnerabilities have been exploited in the wild as of the patch release date.
WatchGuard, which makes network security devices used by businesses to control internet traffic and connect remote workers, has pushed out fixes for more than two dozen software vulnerabilities. Five carry a severity score of 9.3 out of 10, placing them in the critical tier. That same score appeared in our Citrix NetScaler story on 20 August, where researchers warned exploitation followed quickly once details went public. The pattern holds here.
How bad are the critical flaws?
Three of the five need no login to exploit. An attacker anywhere on the internet could send specially crafted network traffic to a vulnerable device and achieve remote code execution, meaning they could run any software they like on the machine.
All three sit inside the iked process of Fireware OS. That's the component responsible for negotiating the encrypted tunnels used by VPNs, the virtual private networks that let employees connect securely from outside the office.
| CVE ID | Flaw type | What it allows |
|---|---|---|
| CVE-2026-19313 | Heap buffer overflow (memory error that lets attackers write data outside a program's reserved space) | Remote code execution |
| CVE-2026-19318 | Stack-based buffer overflow (similar memory error on a different part of the program's workspace) | Remote code execution |
| CVE-2026-19315 | Type confusion (the software misreads data it receives, opening a path to manipulation) | Remote code execution |
A fourth critical flaw, CVE-2026-13086, is a stack-based buffer overflow in the Endpoint Protection Manager service tied to a deprecated Mobile Security feature. It also allows remote code execution.
What about the account takeover bug?
The fifth critical vulnerability, CVE-2026-78174, works differently. It sits in WatchGuard Dimension, a logging and visibility platform used to monitor network devices. A low-privileged administrator could exploit it to extract a super-administrator's active session ID and CSRF token (a security value that normally blocks unauthorised actions), then take over the account entirely.
Beyond the five critical issues, the patch batch closes seven high-severity bugs that could crash devices, five high-severity Dimension flaws covering command execution and admin password tampering, and 11 medium-severity issues.
What should organisations do right now?
Update immediately. Fixed versions are Fireware OS 2026.2.2, 12.12.2, and 12.5.20, and Dimension version 2.3.1. Unauthenticated remote code execution flaws don't stay quiet once public details are out. Organisations should also confirm the Dimension management interface isn't exposed directly to the internet: account-takeover bugs are far easier to exploit when an attacker can reach the login page without stepping inside the network first.
