CVE-2026-13373 WatchGuard CVE debrief

Who should care

This vulnerability affects users of WatchGuard Fireware OS versions 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2. System administrators and security teams responsible for managing and securing WatchGuard Firebox devices should prioritize patching this vulnerability to prevent potential XSS attacks.

Technical summary

The CVE-2026-13373 vulnerability is caused by improper neutralization of input during web page generation, leading to a Stored XSS vulnerability. This issue allows an attacker to inject malicious scripts into the application, which can then be executed by other users. The vulnerability has a CVSS score of 4.8 and a medium severity level. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority should be given to patching this vulnerability, as it is a Stored XSS vulnerability with a medium CVSS score. However, given that this is an additional unmitigated attack path for CVE-2025-13936, it is essential to address this vulnerability promptly to prevent potential attacks.

Recommended defensive actions

• Apply the patches provided by WatchGuard for the affected Fireware OS versions.
• Upgrade to a non-vulnerable version of Fireware OS.
• Implement additional security controls, such as input validation and output encoding, to prevent XSS attacks.
• Monitor the affected systems for any suspicious activity.
• Review and update incident response plans to address potential XSS attacks.

Evidence notes

The CVE-2026-13373 vulnerability was published on July 3, 2026, and last modified on July 9, 2026. The NVD entry is currently Analyzed. The vulnerability is related to CWE-79, Improper Neutralization of Input During Web Page Generation.

Official resources