CVE-2026-3987
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.
Risk Assessment
An attacker with privileges could take control of the device, potentially compromising the entire network.
Recommendation
Upgrade Fireware OS to the latest patched version.
Other vulnerabilities in WatchGuard Fireware OS
See all- CVE-2026-19318Critical
A stack-based buffer overflow in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-19315Critical
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-19313Critical
A heap overflow vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-13086Critical
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
- CVE-2025-14733CriticalActively exploited
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. It affects both mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. Even after deleting those configurations, if a branch office VPN to a static gateway peer remains, the Firebox may still be vulnerable.
- CVE-2025-9242CriticalActively exploited
Out-of-bounds write vulnerability in the iked process of WatchGuard Fireware OS. A remote unauthenticated attacker can execute arbitrary code. Affects mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. If configurations were deleted but a branch office VPN to a static peer remains, the device may still be vulnerable.
- CVE-2026-78011High
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78010High
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78009High
An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78008High
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Original NVD description (English source)
A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.