Cross-site Scripting Vulnerability in WatchGuard Fireware OS
CVE-2026-13373

4.8MEDIUM

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists

What is CVE-2026-13373?

A stored Cross-site Scripting (XSS) vulnerability exists in WatchGuard Fireware OS, specifically within the Tigerpaw Technology Integration module. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users, potentially compromising their data and security. This flaw presents an additional attack vector that remains unaddressed from previous vulnerabilities, enabling further exploitation within affected systems. Users of Fireware OS versions from 12.4 to 12.12, as well as certain builds of versions 12.5 and 2025.1 to 2026.2, are encouraged to review protective measures urgently.

Affected Version(s)

Fireware OS Default 2025.1 < 2026.2.1

Fireware OS Default 12.4 < 12.12.1

Fireware OS T15/T35 12.4 < 12.5.19

References

https://psirt.watchguard.com/CVE-2026-13373
vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-...
vendor-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simone Paganessi (https://www.linkedin.com/in/simonepaganessi)
.