CVE-2026-13375 WatchGuard CVE debrief

Who should care

Users of WatchGuard Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2 should apply patches or mitigations. This includes operators, administrators, and security teams responsible for managing and securing WatchGuard Fireware OS deployments.

Technical summary

The vulnerability is caused by improper neutralization of input during web page generation in WatchGuard Fireware OS (Autotask Technology Integration module). This allows Stored XSS attacks. The affected versions are Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2. The CVE record was published on 2026-07-03T00:16:51.373Z and has not been modified since then.

Defensive priority

Medium

Recommended defensive actions

• Apply patches or mitigations provided by WatchGuard
• Review and update Fireware OS to a non-vulnerable version
• Implement compensating controls such as web application firewalls
• Monitor for suspicious activity and exception tracking
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-03T00:16:51.373Z and was last modified on 2026-07-07T18:16:34.907Z. The NVD entry is currently Undergoing Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE is an additional unmitigated attack path for CVE-2025-13938.

Official resources