Known vulnerabilities in Fireware OS 12.6.2 Update 1

Vendor: WatchGuard
Software: Fireware OS
Version: 12.6.2 Update 1
Software CPE: cpe:2.3:o:watchguard:fireware_os:*:*:*:*:*:*:*:*
Total vulnerabilities: 41
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Fireware OS version 12.6.2 Update 1 Fireware OS 12.6.2 Update 1 is affected by 41 vulnerabilities: 3 critical, 4 high, 7 medium, 27 low Critical High Medium Low

Vulnerabilities (41)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136894 - Use of Hard-coded Cryptographic Key
CVE-2026-13728
CWE-321 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136893 - NULL Pointer Dereference
CVE-2026-13084
CWE-476 Medium
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136892 - Use After Free
CVE-2026-13368
CWE-416 High
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136891 - Improper Validation of Integrity Check Value
CVE-2026-13722
CWE-354 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136890 - Out-of-bounds write
CVE-2026-13384
CWE-787 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136889 - Out-of-bounds write
CVE-2026-13383
CWE-787 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136888 - Deserialization of Untrusted Data
CVE-2026-13371
CWE-502 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136887 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-13373
CWE-79 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136886 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-13374
CWE-79 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136885 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-13375
CWE-79 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136884 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-13376
CWE-79 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136883 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-13377
CWE-79 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136882 - Out-of-bounds write
CVE-2026-13053
CWE-787 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136881 - Out-of-bounds write
CVE-2026-13050
CWE-787 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136880 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-13054
CWE-22 Low
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU136878 - Out-of-bounds write
CVE-2026-8247
CWE-787 High
No
No
12.12.1, 2026.2.1 03.07.2026 SB2026070353
#VU124818 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-3987
CWE-22 Low
No
No
12.12, 2026.2 02.04.2026 SB2026040226
#VU124662 - Deserialization of Untrusted Data
CVE-2026-4266
CWE-502 Low
No
No
12.12, 2026.2 27.03.2026 SB2026032741
#VU124661 - Cross-Site Request Forgery (CSRF)
CVE-2026-4315
CWE-352 Low
No
No
12.5.18, 12.12, 2026.2 27.03.2026 SB2026032740
#VU123429 - Out-of-bounds write
CVE-2026-3342
CWE-787 Low
No
No
12.5.17, 12.11.8, 2026.1.2 03.03.2026 SB2026030321


Showing elements 1 - 20 out of 41