ACTIVELY EXPLOITED
CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
| Vendor | WatchGuard |
|---|---|
| Product | Firebox and XTM |
| Actively exploited | Yes |
| Added to CISA KEV | 11 Apr 2022 |
| CISA federal deadline | 2 May 2022 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
SOURCES
Other WatchGuard flaws
- CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability
- CVE-2025-9242: WatchGuard Firebox Out-of-Bounds Write Vulnerability
- CVE-2022-26318: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.