WatchGuard Fireware OS: several critical vulnerabilities, updates available

What happened

On 29 October 2026, several serious vulnerabilities in WatchGuard Fireware OS became public. Fireware OS is the operating system of WatchGuard firewalls and security appliances. The flaws are described as critical. WatchGuard has released updates. As of today, there are no reports of active attacks.

The available information does not include technical details, CVE IDs or the exact affected and fixed versions. These are listed in the WatchGuard security advisories.

Who is affected

You are affected if you run WatchGuard firewalls or security appliances with Fireware OS, either for your own network or for customers. Firewalls sit at the edge of the network and are often reachable from the internet. A flaw in them can affect every server and system behind them.

To see which Fireware OS versions are vulnerable and which versions fix the problems, check the vendor advisory linked below.

What to do now

1. List all WatchGuard appliances you manage, including those at customer sites, and note the Fireware OS version of each.
2. Compare these versions with the WatchGuard security advisory to find out which devices are affected and which update you need.
3. Back up the current configuration of each device before updating.
4. Install the fixed Fireware OS version. Plan for a reboot and a short interruption, and schedule it for a quiet time if you can, but do not delay it for long.
5. After the reboot, check that the device runs the new version and that VPN connections, firewall policies and other key services work as before.
6. Until the update is installed, limit access to the management interfaces (Web UI, management ports) to trusted IP addresses or internal networks only.

How to check whether you are affected

• Check the installed Fireware OS version in the Web UI or in WatchGuard System Manager and compare it with the affected versions in the vendor advisory.
• Check which services and management interfaces are reachable from the internet. Only expose what you really need.
• Review the device logs for unusual administrator logins, configuration changes you did not make and unexpected accounts. If you find any, treat the device as possibly compromised, change the administrator passwords and VPN credentials, and look at the configuration closely.

Sources

• https://www.heise.de/news/Diverse-kritische-Schwachstellen-in-WatchGuard-Fireware-OS-11504873.html