CVE-2022-26318: WatchGuard Fireware OS unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 unauthenticated network code execution on an internet-facing security appliance, combined with KEV listing and very high EPSS, makes this an urgent patch.

What it is

WatchGuard Firebox and XTM appliances running Fireware OS contain an unauthenticated remote code execution flaw tracked as FBX-22786. An attacker who can reach the management interface can run arbitrary code without credentials, which is severe for an internet-facing security appliance. The record does not name the specific vulnerable component or root cause beyond a generic CWE-Other classification.

Impact

An attacker gains arbitrary code execution on the appliance, typically at the privilege of the exposed service, allowing full compromise of the device and any traffic or credentials it handles. Because the device is a security gateway, compromise can also expose the networks behind it.

Attack surface

Reachable over the network via the CVSS vector AV:N/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not specify which service or port is targeted, so defenders must treat any exposed management or web interface as the likely path.

Exploitation

Listed in CISA KEV with a 2022-03-25 addition and a 2022-04-15 remediation due date, indicating known exploitation in the wild. EPSS is 0.78157 (99.55th percentile), consistent with high observed exploitation likelihood. No ransomware campaign use is recorded.

What to do

• Upgrade Fireware OS to 12.7.2_U2 or later; for 12.x upgrade to 12.1.3_U8 or later, and for 12.2.x through 12.5.x upgrade to 12.5.9_U2 or later.
• If immediate patching is not possible, remove management and web interfaces from internet exposure and restrict access to trusted administrative networks.
• Enable and review logging on the appliance and any upstream firewall for unexpected access to management ports.
• Rotate credentials and inspect appliance configuration for unauthorized changes after any suspected exposure window.
• Verify patched versions against the vendor release notes rather than relying on the CVE description alone.

Detection

• Monitor appliance and perimeter logs for unauthenticated requests to management or web interfaces from unexpected source IPs.
• Alert on new or modified processes, files, or configuration entries on Firebox/XTM appliances.
• Hunt for outbound connections from the appliance to unfamiliar hosts, which may indicate post-exploitation activity.
• Correlate access logs with the KEV remediation window to identify systems that were exposed before patching.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.