Known exploited vulnerabilities
WatchGuard vulnerabilities attackers have used
Every WatchGuard vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 4 WatchGuard vulnerabilities as exploited in the wild, 2 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2025-14733, added Dec 19, 2025. Firebox has the most entries (2).
- In KEV, all time
- 4
- Added, last 12 months
- 2
- Used in ransomware
- 1
- New CVEs this week
- 0
By product
Firebox (2), Firebox and XTM (1), Firebox and XTM Appliances (1).
Every WatchGuard entry in CISA KEV
WatchGuard Firebox Out of Bounds Write Vulnerability
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with…
CVE-2025-9242
Added · dueWatchGuard Firebox Out-of-Bounds Write Vulnerability
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
CVE-2022-23176
Added · dueWatchGuard Firebox and XTM Privilege Escalation Vulnerability
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
CVE-2022-26318
Added · dueWatchGuard Firebox and XTM Appliances Arbitrary Code Execution
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.