Security tracker
CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability
In short
WatchGuard Firebox has a weakness classified as out-of-bounds write (CWE-787). CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-19. NVD lists CVSS 4.0 at 9.3 CRITICAL. CISA reports known ransomware campaign use.
What it is
“WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.” — CISA KEV, retrieved 2026-11-01
“An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.” — NVD, retrieved 2026-11-01
Who is affected
WatchGuard Firebox. NVD lists the following versions as affected:
- Versions from 11.10.2 inclusive, before 12.5.15
- Versions from 11.10.2 inclusive, before 12.11.6
- Versions from 2025.1 inclusive, before 2025.1.4
Exploitation status
CISA KEV added: 2025-12-19. Known ransomware campaign use: Known (reported by CISA). Due date CISA set for US federal civilian agencies: 2025-12-26.
Scores
NVD CVSS 4.0: 9.3 CRITICAL; vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red; source 5d1c2695-1a31-4499-88ae-e847036fd7e3.
EPSS by FIRST: 29.42%; percentile 98.18; score date 2026-10-31. EPSS estimates the probability of exploitation in the next 30 days.
CWE: CWE-787.
Timeline
| Date | Event |
|---|---|
| 2025-12-19 | CISA KEV added |
| 2025-12-19T01:16:05.530 | NVD published |
| 2025-12-26 | CISA KEV due |
| 2026-09-09T04:17:52.700 | NVD last modified |
| 2026-10-31 | FIRST EPSS score |
CISA required action
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” — CISA KEV
What to do
- Confirm whether you run WatchGuard Firebox and which version.
- Apply the vendor update or mitigation in the advisory.
- Follow CISA’s required action.
- Review the vendor guidance on signs of compromise.
- Track the fix through completion.
Sources and dates
CISA Known Exploited Vulnerabilities Catalog, version 2026.10.30; retrieved 2026-11-01. CISA KEV data: CC0 1.0. No endorsement by CISA.
NVD retrieved: 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.
EPSS scores by FIRST; score date 2026-10-31.
Check your own domain's public security settings
The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for this CVE.