CVE catalog

CVE-2026-13728

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect de

[CVE catalog]

Severity: Medium · CVSS 5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Jul 2, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	fireware	Not reported	`12.12.1`	fixed
Cpe	fireware	Not reported	`2026.2.1`	fixed
Cpe	fireware	Not reported	`2026.2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	fireware	cpe	Not reported	`12.12.1`	Not reported	Not reported	Not reported
Cpe	fireware	cpe	Not reported	`2026.2.1`	Not reported	Not reported	Not reported
Cpe	fireware	cpe	Not reported	`2026.2.1`	Not reported	NVD-CVE-2026-13728	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 9:44:34 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]