CVE-2026-13054
Received Received - Intake

Path Traversal in WatchGuard Fireware OS Management Web UI

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: WatchGuard Technologies, Inc.

Description
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-03
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-13054
EUVD
EUVD-2026-41461

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
watchguard fireware_os From 11.0 (inc) to 11.12.4_Update1 (inc)
watchguard fireware_os From 12.0 (inc) to 12.12 (inc)
watchguard fireware_os From 12.5 (inc) to 12.5.18 (inc)
watchguard fireware_os From 2025.1 (inc) to 2026.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the WatchGuard Fireware OS Management Web UI. It allows a privileged authenticated attacker to write arbitrary files onto the Firebox's filesystem.

It affects multiple versions of Fireware OS, specifically versions 11.0 through 11.12.4_Update1, 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2.

Impact Analysis

The vulnerability allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem, which can lead to unauthorized modification or insertion of malicious files.

This can compromise the integrity and security of the device, potentially allowing further exploitation or disruption of network security functions.

Given the high CVSS score of 8.6, the impact is considered severe.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your WatchGuard Fireware OS to a fixed version where the issue is resolved.

  • Upgrade to Fireware OS version 2026.2.1 or later.
  • Upgrade to Fireware OS version 12.12.1 or later.
  • Upgrade to Fireware OS version 12.5.x for T15 and T35 models.

Note that versions 11.x remain vulnerable as they have reached end of life and no fixes are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart