WatchGuard · Firebox and XTM Appliances

CVE-2022-26318

WatchGuard Firebox and XTM Appliances Arbitrary Code Execution

Exploited in attacks Critical 9.8 Attack chance: 78%

What it is

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

CISA: On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: March 4, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 78% in the top 0.4% of all known vulnerabilities
Weakness: CWE-122
More details: NVD · CVE.org · CISA

All references (1)

https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html…

More exploited flaws from WatchGuard

Added	Vulnerability	Product	Severity	Attack chance
Dec 19, 2025	Out of Bounds WriteCVE-2025-14733used by ransomware	Firebox	Critical 9.3	29%
Nov 12, 2025	Out-of-Bounds WriteCVE-2025-9242	Firebox	Critical 9.3	92%
Apr 11, 2022	Privilege EscalationCVE-2022-23176	Firebox and XTM	High 8.8	11%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.