WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database
Priority LOW 26CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-08
Fix Fixed Fireware OS (WatchGuard): 2026.2.1, 12.12.1, 12.11.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 2025.1 to before 2026.2.1; 12.0 to before 12.12.1 | 2026.2.1, 12.12.1 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.11.9 | 12.11.9 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 2025.1 to before 2026.2.1; 12.0 to before 12.12.1 Fixed in 2026.2.1, 12.12.1 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.11.9 Fixed in 12.11.9 Patch available CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.1 to before 12.12.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.1 to before 12.12.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 2025.1 to before 2026.2.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 2025.1 to before 2026.2.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 2026.2.1, 12.12.1
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.11.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WatchGuard Fireware OS 12.11.9, 12.12.1, 2026.2.1
16 records Highest priority Priority MEDIUM 7 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-11132 Null Pointer Dereference in WatchGuard Fireware OS iked ProcessPriority MEDIUM 45
- TI-2026-11326 WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationPriority MEDIUM 43
- TI-2026-11340 WatchGuard Firebox wgagent Out of Bounds Write VulnerabilityPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13728
- 2026-10-03 Alias added: GHSA-jw2p-m8jh-c458
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2026-13728 · CVE Program
- CVE-2026-13728 · NVD
- FIRST EPSS
- GHSA-jw2p-m8jh-c458 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences