Cross-Site Scripting Vulnerability in WatchGuard Fireware OS
CVE-2026-13375

4.8MEDIUM

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
2 July 2026

What is CVE-2026-13375?

A Cross-Site Scripting (XSS) vulnerability in the Autotask Technology Integration module of WatchGuard Fireware OS allows for the persistent injection of malicious scripts. This stored XSS vulnerability can be exploited by attackers, providing them an additional means to compromise users' data and manipulate web pages without proper validation. It affects multiple versions of Fireware OS, creating significant security concerns for users operating those versions.

Affected Version(s)

Fireware OS 12.4 <= 12.12

Fireware OS 12.5 <= 12.5.18

Fireware OS 2025.1 <= 2026.2

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-...
vendor-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simone Paganessi (https://www.linkedin.com/in/simonepaganessi)
.