Fireware OS Web UI Clicking Malicious Links Can Execute Unauthorized Code

Summary

An attacker can trick an authenticated Fireware OS administrator into clicking a malicious link, allowing the attacker to run unauthorized code in the administrator's browser. This can lead to unauthorized access or data theft. Fireware OS users should update to the latest version to prevent this vulnerability.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
watchguard	fireware	> 12.7 , <= 12.11.8	–
watchguard	fireware	> 2025.1 , <= 2026.1.2	–

Original title

A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click...

Original description

A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.

This vulnerability affects Fireware OS 12.7 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00004 Vendor Advisory