CVE catalog

CVE-2026-13054

A path traversal vulnerability in the WatchGuard…

[CVE catalog]

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

Severity
High · CVSS 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedfirewareNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedfireware12.12.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedfireware2026.2.1UnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedfirewareNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedfireware12.12.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedfireware2026.2.1UnknownSource applicability is not establishedProvider not reported
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "fireware",
      "fixed_version": "12.12.1",
      "applicability_unknown": true
    },
    {
      "name": "fireware",
      "fixed_version": "2026.2.1",
      "applicability_unknown": true
    },
    {
      "name": "fireware",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "fireware",
      "ranges": [
        {
          "fixed": "",
          "introduced": "11.0",
          "last_affected": "12.5.18",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13054",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-13054",
      "provider_updated_at": "2026-10-25T21:10:00.770"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]