OS Command Injection in Fireware OS - CVE-2022-26318
Published: December 16, 2025
Vulnerability identifier: #VU119990
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-26318
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. A remote unauthenticated attacker can send a specially crafted XML-RPC request to the /agent/ endpoint and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Fireware OS
How to mitigate CVE-2022-26318
Install updates from vendor's website.
Fireware OS - addressed in versions 12.1.3 Update 8, 12.5.9 Update 2, 12.7.2 Update 2
Links to Public Exploits and PoC-codes
- Exploit #12202 - Watchguard-RCE-POC-CVE-2022-26318 (Watchguard RCE POC CVE-2022-26318) (December 16, 2025)
- Exploit #12201 - watchguard_cve-2022-26318 () (December 16, 2025)
- Exploit #12200 - CVE-2022-26318 () (December 16, 2025)
- Exploit #12199 - WatchGuard XTM Firebox Unauthenticated Remote Command Execution (December 16, 2025)