Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

WatchGuard: actively exploited vulnerabilities

4 vulnerabilities in WatchGuard products (Firebox / XTM (Fireware)) are in CISA’s catalog of exploited vulnerabilities. Last added: December 19, 2025.

WatchGuard security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one WatchGuard category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Firebox / XTM (Fireware) 4 vulnerabilities · Firewalls and VPNs

Name used by CISA: WatchGuard. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this WatchGuard list.

  1. Rank 1WatchGuard Firebox / XTM (Fireware)

    CVE-2025-14733

    Ransomware

    WatchGuard Firebox Out of Bounds Write Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Dec 19, 2025
    CISA deadline
    7 days
    CVSS severity
    9.8 (critical)

  2. Rank 2WatchGuard Firebox / XTM (Fireware)

    CVE-2025-9242

    WatchGuard Firebox Out-of-Bounds Write Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Nov 12, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3WatchGuard Firebox / XTM (Fireware)

    CVE-2022-26318

    WatchGuard Firebox and XTM Appliances Arbitrary Code Execution

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  4. Rank 4WatchGuard Firebox / XTM (Fireware)

    CVE-2022-23176

    WatchGuard Firebox and XTM Privilege Escalation Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Apr 11, 2022
    CISA deadline
    21 days
    CVSS severity
    8.8 (high)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.