CVE-2026-13224

Analyzed Analyzed - Analysis Complete

Path Traversal in Fireware OS WebUI Management Agent

Publication date: 2026-09-30

Last updated on: 2026-10-08

Assigner: WatchGuard Technologies, Inc.

Description

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-13224

EUVD

EUVD-2026-89496

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	fireware	From 12.0 (inc) to 12.5.21 (exc)
watchguard	fireware	From 12.12 (inc) to 12.12.3 (exc)
watchguard	fireware	From 2026.3 (inc) to 2026.3.2 (exc)
watchguard	fireware	From 2025.0 (inc) to 2026.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Fireware OS WebUI management agent. An authenticated administrator can exploit it by sending a specially crafted request to read or list arbitrary files on the local filesystem. It affects Fireware OS versions 12.0 and later but below 12.5.21, 2026.3.2, 2026.2.3, and 12.12.3.

Detection Guidance

Since this is a path traversal vulnerability in Fireware OS WebUI, detection requires checking Fireware OS versions. Verify if your system runs versions 12.0 or later but below 12.5.21, 2026.3.2, 2026.2.3, or 12.12.3. Use the WebUI or CLI to check the version. No specific commands are provided in the resources.

Impact Analysis

An attacker with admin access could read sensitive files on the system, potentially exposing confidential data or system configurations. This could lead to further attacks or unauthorized access if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate strict data protection and access controls.

Mitigation Strategies

Immediately update Fireware OS to the patched versions: 12.5.21, 2026.3.2, 2026.2.3, or 12.12.3. Ensure only trusted administrators have access to the WebUI management interface to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-13224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70