CVE-2026-13728

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

CVSS 4.0

5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

CVSS 3.1

4.4CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)

CWE

CWE-798

Published

2026-07-03

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• watchguard:fireware

References

• https://psirt.watchguard.com/CVE-2026-13728
• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00025

Check your stackJSON