FO
Product
Fireware OS
On CISA KEVExploited in the wildRansomware-linked
90
CVEs
2
On KEV
9.8
Max CVSS
32
New 30D
Severity mix
Critical 14High 44Medium 32Low 0
Watch
Add Fireware OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14733 RansomwareIn wildKEV | 9.8 | Dec 19 | WatchGuard Firebox iked Out of Bounds Write Vulnerability Affected: 2025.1 before 2025.1.4; 12.0 before 12.11.6; 11.10.2 through 11.12.4+541730; 12.0 before 12.3.1+728352; 12.0 before 12.5.15 |
| CVE-2025-9242 In wildKEV | 9.8 | Sep 17 | WatchGuard Firebox iked Out of Bounds Write Vulnerability Affected: 11.0 through 11.12.4+541730; 12.0 before 12.11.4; 2025.0 before 2025.1.1; 12.0 before 12.3.1+722811; 12.0 before 12.5.13 |
| CVE-2026-86131 | 9.8 | Sep 29 | Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution Affected: 2026.3 before 2026.3.2; 2025.0 before 2026.2.3; 12.0 before 12.12.3; 12.0 before 12.5.21 |
| CVE-2026-103594 New | 9.5 | Oct 27 | Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution Affected: 2026.2 before 2026.4; 12.12 before 12.12.4 |
| CVE-2026-90465 New | 9.4 | Oct 27 | Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
| CVE-2026-19315 | 9.3 | Aug 27 | Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution Affected: 2025.0 before 2026.2.2; 12.0 before 12.12.2; 2026.3 before 2026.3.1; 12.0 before 12.5.20 |
| CVE-2026-13086 | 9.3 | Aug 27 | Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint Affected: 2025.0 before 2026.2.2; 12.0 before 12.12.2; 2026.3 before 2026.3.1; 12.0 before 12.5.20 |
| CVE-2026-19313 | 9.3 | Aug 27 | Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution Affected: 2025.0 before 2026.2.2; 12.0 before 12.12.2; 12.0 before 12.5.20; 2026.3 before 2026.3.1 |
| CVE-2026-19318 | 9.3 | Aug 27 | Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution Affected: 2025.0 before 2026.2.2; 12.0 before 12.12.2; 12.0 before 12.5.20; 2026.3 before 2026.3.1 |
| CVE-2026-112709 New | 9.2 | Oct 27 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
| CVE-2026-112710 New | 9.2 | Oct 27 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
| CVE-2026-93857 New | 9.2 | Oct 27 | Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
| CVE-2026-93866 New | 9.2 | Oct 27 | Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
| CVE-2026-93865 New | 9.2 | Oct 27 | Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection Affected: 2025.1 before 2026.4; 12.0 before 12.12.4; 12.0 before 12.5.22 |
Showing 14