CVE-2026-13376

Analyzed Analyzed - Analysis Complete

Stored XSS in WatchGuard Fireware OS SpamBlocker Module

Publication date: 2026-07-03

Last updated on: 2026-07-09

Assigner: WatchGuard Technologies, Inc.

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-09

Generated

2026-07-23

AI Q&A

2026-07-03

EPSS Evaluated

2026-07-22

NVD

CVE-2026-13376

EUVD

EUVD-2026-41451

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	fireware	From 12.0 (inc) to 12.12.1 (exc)
watchguard	fireware	From 2025.1 (inc) to 2026.2.1 (exc)
watchguard	fireware	From 12.5 (inc) to 12.5.18 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-13376 is a stored Cross-Site Scripting (XSS) vulnerability found in the spamBlocker module of WatchGuard Firebox devices running certain versions of Fireware OS. It occurs due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that are stored and later executed in the context of a user's browser.

Detection Guidance

Detection of the stored Cross-Site Scripting (XSS) vulnerability in the spamBlocker module of WatchGuard Fireware OS involves monitoring for malicious script injections in web pages generated by the affected Firebox devices.

Since this vulnerability arises from improper neutralization of input during web page generation, one approach is to inspect the web interface or logs of the Firebox devices for unexpected or suspicious script tags or payloads.

Specific commands or automated detection scripts are not provided in the available resources.

It is recommended to verify the Fireware OS version running on your devices and compare it against the affected versions (12.0 up to 12.12, 12.5 up to 12.5.18, and 2025.1 up to 2026.2). Upgrading to the fixed versions (2026.2.1 for 2025.1 branch and 12.12.1 for 12.x branch) is advised to mitigate the vulnerability.

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the context of the affected device's web interface, potentially leading to unauthorized actions, data theft, or session hijacking. Since it is a stored XSS, the malicious code can persist and affect multiple users who access the vulnerable interface. The impact is considered medium with a CVSS score of 4.8.

Compliance Impact

The provided information does not specify how the CVE-2026-13376 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate the stored Cross-Site Scripting (XSS) vulnerability in the spamBlocker module of WatchGuard Firebox devices, you should upgrade your Fireware OS to the fixed versions.

Upgrade to Fireware OS 2026.2.1 if you are running the 2025.1 branch.
Upgrade to Fireware OS 12.12.1 if you are running the 12.x branch.

Note that some 12.5.x models (specifically T15 & T35) remain unresolved, so verify your device model and consider additional mitigations or vendor guidance.

Hi! I’m here to help you understand CVE-2026-13376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70