Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2026-13376: WatchGuard Firebox spamBlocker Module Allows Malicious Code Injection
CVE-2026-13376 · published 4 months ago
Summary
WatchGuard Firebox users are at risk of having malicious code injected into their system through the spamBlocker module. This could allow an attacker to take control of the system or steal sensitive information. Users should update their Firebox to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| watchguard | fireware os |
<= 12.12 < 2026.2.1 < 12.5.19 < 12.11.9 |
| watchguard | fireware |
>= 12.0, < 12.12.1 >= 2025.1, < 2026.2.1 >= 12.5, <= 12.5.18 cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* |
Original advisory text
WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Jul 2026
Updated3 Nov 2026
First seen2 Jul 2026
Track software like this
Free during beta