ACTIVELY EXPLOITED
CVE-2022-26318: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution
| Vendor | WatchGuard |
|---|---|
| Product | Firebox and XTM Appliances |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Mar 2022 |
| CISA federal deadline | 15 Apr 2022 |
| Weakness (CWE) | CWE-122 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
SOURCES
Other WatchGuard flaws
- CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability
- CVE-2025-9242: WatchGuard Firebox Out-of-Bounds Write Vulnerability
- CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.