Changeflow GovPing Data Privacy & Cybersecurity WatchGuard Firebox Remote Code Execution Vulner...
Priority review Notice Added Final

WatchGuard Firebox Remote Code Execution Vulnerability

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published April 1st, 2026
Detected April 2nd, 2026
Email

Summary

CERT-Bund published security advisory WID-SEC-2026-0952 reporting a high-severity vulnerability (CVSS 7.2) in WatchGuard Firebox and Unified Threat Management products. An authenticated remote attacker can exploit this flaw to execute arbitrary code on affected systems. Versions prior to 2026.2 and 12.12 are vulnerable.

What changed

CERT-Bund reported CVE-2026-0952, a remote code execution vulnerability affecting WatchGuard Firebox devices running versions below 2026.2 and 12.12. The vulnerability allows authenticated remote attackers to execute arbitrary code by exploiting the flaw in the affected firewall products. No additional CVE details are currently publicly linked.

Organizations using WatchGuard Firebox products should immediately verify their device versions, apply available patches or mitigations, restrict management interface access to trusted networks only, and monitor for indicators of compromise. Given the high CVSS score and remote exploitability, prioritize patching within 30 days.

What to do next

  1. Identify all WatchGuard Firebox devices and verify current version numbers
  2. Apply vendor patches or workarounds immediately, prioritizing internet-facing devices
  3. Restrict management interface access to trusted IP ranges and monitor for anomalous activity

Source document (simplified)

[WID-SEC-2026-0952] WatchGuard Firebox: Schwachstelle ermöglicht Codeausführung CVSS Base Score 7.2 (hoch) CVSS Temporal Score 6.3 (mittel) Remoteangriff ja Datum 01.04.2026 Stand 02.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Sonstiges

Produktbeschreibung

WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.

Produkte

01.04.2026
- WatchGuard Firebox <2026.2

  • WatchGuard Firebox <12.12

Angriff

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in WatchGuard Firebox ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Named provisions

Betroffene Systeme Angriff

Source

Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
April 1st, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-0952

Who this affects

Applies to
Technology companies Government agencies
Industry sector
3341 Computer & Electronics Manufacturing 5170 Telecommunications
Activity scope
Vulnerability Management Network Security
Threshold
WatchGuard Firebox versions <2026.2 and <12.12
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF NERC CIP
Topics
Data Privacy Network Security

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.