WatchGuard

Latest CVEs · RSS

• CVE-2026-13043 2026-10-01 · CVSS 9.3
  A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated a
• CVE-2026-86134 2026-09-30 · CVSS 8.7
  A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management
• CVE-2026-86104 2026-09-29 · CVSS 8.7
  An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of ser
• CVE-2026-18145 2026-09-29 · CVSS 8.6
  A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator pri
• CVE-2026-86101 2026-09-29 · CVSS 7.2
  An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access P
• CVE-2026-13046 2026-09-29 · CVSS 7.5
  A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already ob
• CVE-2026-86131 2026-09-29 · CVSS 9.2
  A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to
• CVE-2026-13224 2026-09-29 · CVSS 8.2
  A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local file
• CVE-2026-86133 2026-09-29 · CVSS 8.2
  An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to cra
• CVE-2026-90441 2026-09-29 · CVSS 7.1
  A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including
• CVE-2026-18105 2026-09-29 · CVSS 7.1
  An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of se
• CVE-2026-86105 2026-09-29 · CVSS 5.3
  An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other
• CVE-2026-86136 2026-09-29 · CVSS 7.1
  A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including
• CVE-2026-86132 2026-09-29 · CVSS 8.2
  An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a
• CVE-2026-86128 2026-09-29 · CVSS 8.2
  A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of servi
• CVE-2026-81433 2026-09-29 · CVSS 8.7
  A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent ne
• CVE-2026-86102 2026-09-28 · CVSS 9.3
  An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell comm
• CVE-2026-87969 2026-09-28 · CVSS 8.6
  An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands b
• CVE-2026-101891 2026-09-28 · CVSS 9.3
  An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP
• CVE-2026-95676 2026-09-23 · CVSS 7.4
  A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass s
• CVE-2026-86135 2026-09-08 · CVSS 7.0
  A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized
• CVE-2026-78616 2026-08-27 · CVSS 4.8
  A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execut
• CVE-2026-78498 2026-08-27 · CVSS 5.1
  A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate
• CVE-2026-78612 2026-08-27 · CVSS 8.6
  WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report admini
• CVE-2026-78103 2026-08-27 · CVSS 5.1
  WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unl