{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "WatchGuard heeft meerdere kwetsbaarheden verholpen in Fireware OS.", "title": "Feiten" }, { "category": "description", "text": "De impact van deze kwetsbaarheden varieert, net als de toegangsrechten die nodig zijn voor misbruik.\n\n- Een aanvaller met schrijfrechten op het systeem kan via een kwetsbaarheid in SAML single sign-on-sessies een kwaadaardig sessiebestand laden en arbitraire code uitvoeren.\n- Geauthenticeerde beheerders kunnen via path traversal in de WebUI Management Agent willekeurige lokale bestanden lezen. Een low-privileged geauthenticeerde gebruiker kan via resource-uitputting van diagnostische tools een denial-of-service veroorzaken. \n- De spamBlocker-service bevat een stack-based buffer overflow die door een geauthenticeerde beheerder kan leiden tot een crash of code-executie. \n- Een stack-based buffer overflow in de DHCP fingerprinting-daemon kan door een niet-geauthenticeerde aanvaller met netwerktoegang worden misbruikt voor code-executie of een crash. \n- Een geauthenticeerde gebruiker met beperkte Access Portal-rechten kan via een SAML-login kwetsbaarheid ongeautoriseerde toegang tot Mobile VPN with SSL verkrijgen. \n- Een remote, niet-geauthenticeerde aanvaller kan via resource-uitputting in het wgagent-loginproces een denial-of-service veroorzaken. \n- De Access Portal reverse proxy bevat een improper authorization-kwetsbaarheid waardoor geauthenticeerde gebruikers met beperkte rechten toegang kunnen krijgen tot ongeautoriseerde webapplicaties.\n- Een NULL pointer dereference in de NetFlow-packetverwerking kan door een remote, niet-geauthenticeerde aanvaller een crash veroorzaken. \n- De BOVPN Over TLS-clientconfiguratie bevat een code-injection-kwetsbaarheid waardoor een aanvaller die de remote VPN-server beheert commando's met rootrechten kan uitvoeren op het Firebox-apparaat.\n- Integer-underflow kwetsbaarheden in de IKE- en IKEv2-daemons kunnen door remote, niet-geauthenticeerde aanvallers worden misbruikt om crashes en daarmee denial-of-service te veroorzaken. \n- Een NULL pointer dereference in het authenticatieproces kan door een remote, niet-geauthenticeerde aanvaller een crash van de managementdaemon veroorzaken. \n- Een OS command injection in de interne API van WatchGuard Access Points kan door een aanvaller met netwerktoegang worden misbruikt voor het uitvoeren van willekeurige commando's.\n- Een CSRF-kwetsbaarheid in WatchGuard Dimension kan het mogelijk maken om zonder toestemming database snapshots te creëren. \n- Een missing authorization-kwetsbaarheid in de wgagent Management API kan door geauthenticeerde gebruikers met beperkte rechten worden misbruikt voor ongeautoriseerde API-verzoeken, crashes en het lezen van willekeurige bestanden. \n- Een kwetsbaarheid in libxml2 kan leiden tot een out-of-bounds read en denial-of-service bij het verwerken van XML-input.", "title": "Interpretaties" }, { "category": "description", "text": "WatchGuard heeft updates uitgebracht om de kwetsbaarheden in Fireware OS te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "general", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Improper Handling of Unicode Encoding", "title": "CWE-176" }, { "category": "general", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Improper Handling of Highly Compressed Data (Data Amplification)", "title": "CWE-409" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Inclusion of Functionality from Untrusted Control Sphere", "title": "CWE-829" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "general", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-13046" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-13224" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-13225/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-18105" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-18145" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-18146/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-81433" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86101" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86102/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86104" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86105" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86106/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86128" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86131" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86132" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86133" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86134" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86135/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86136" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-86137/" }, { "category": "external", "summary": "Reference", "url": "https://psirt.watchguard.com/CVE-2026-90441" } ], "title": "Kwetsbaarheden verholpen in WatchGuard Fireware OS", "tracking": { "current_release_date": "2026-10-07T07:27:17.612003Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0404", "initial_release_date": "2026-10-07T07:27:17.612003Z", "revision_history": [ { "date": "2026-10-07T07:27:17.612003Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Fireware" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Fireware OS" } ], "category": "vendor", "name": "WatchGuard" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-13046", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "description", "text": "A vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling allows attackers with file write access to execute arbitrary code by loading a malicious session file.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-13046 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13046.json" } ], "title": "CVE-2026-13046" }, { "cve": "CVE-2026-13224", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "other", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "description", "text": "A path traversal vulnerability in Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary local files via crafted management requests.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-13224 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13224.json" } ], "title": "CVE-2026-13224" }, { "cve": "CVE-2026-13225", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "title": "CWE-80" }, { "category": "description", "text": "A vulnerability in pretix allows malicious HTML injection into the email address field of an order, which is then rendered unsanitized on the individual ticket confirmation page.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-13225 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13225.json" } ], "title": "CVE-2026-13225" }, { "cve": "CVE-2026-18105", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "An uncontrolled resource consumption vulnerability in Fireware OS allows a low-privileged authenticated user to cause denial of service of diagnostic tools by repeatedly starting and aborting a crafted diagnostic task via the web UI.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-18105 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18105.json" } ], "title": "CVE-2026-18105" }, { "cve": "CVE-2026-18145", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's spamBlocker (spamd) service allows an authenticated administrator to crash the service or potentially execute arbitrary code via a crafted management request.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-18145 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18145.json" } ], "title": "CVE-2026-18145" }, { "cve": "CVE-2026-18146", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "The Fluent Forms WordPress plugin up to version 6.2.11 contains a Stored Cross-Site Scripting vulnerability via Notification Smartcode Values, enabling unauthenticated attackers to execute malicious scripts in the browsers of privileged users viewing form submission logs.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-18146 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18146.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-18146" }, { "cve": "CVE-2026-81433", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A stack-based buffer overflow in WatchGuard Fireware OS's DHCP fingerprinting daemon allows unauthenticated adjacent attackers to execute arbitrary code or crash the process via crafted DHCP packets.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-81433 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-81433.json" } ], "title": "CVE-2026-81433" }, { "cve": "CVE-2026-86101", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "A vulnerability in WatchGuard Fireware OS's SAML login enables an authenticated user with limited Access Portal rights to escalate privileges and gain unauthorized Mobile VPN with SSL access via a crafted request.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86101 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86101.json" } ], "title": "CVE-2026-86101" }, { "cve": "CVE-2026-86102", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "An OS command injection vulnerability in the WatchGuard AP internal API service allows attackers with network access to execute arbitrary shell commands on the device's operating system.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86102 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86102.json" } ], "title": "CVE-2026-86102" }, { "cve": "CVE-2026-86104", "cwe": { "id": "CWE-409", "name": "Improper Handling of Highly Compressed Data (Data Amplification)" }, "notes": [ { "category": "other", "text": "Improper Handling of Highly Compressed Data (Data Amplification)", "title": "CWE-409" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "A resource consumption vulnerability in Fireware OS's wgagent login process allows remote, unauthenticated attackers to cause denial of service by sending specially crafted requests.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86104 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86104.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86104" }, { "cve": "CVE-2026-86105", "cwe": { "id": "CWE-176", "name": "Improper Handling of Unicode Encoding" }, "notes": [ { "category": "other", "text": "Improper Handling of Unicode Encoding", "title": "CWE-176" }, { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy enables authenticated low-privileged users to access unauthorized web applications by crafting specific requests for accessible resources.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86105 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86105.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86105" }, { "cve": "CVE-2026-86106", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A vulnerability in VeloCloud Edge HA allows unauthenticated actors with Layer 2 access to the private HA interconnect to trigger sensitive HA peer functions, potentially leading to elevated command execution without verification.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86106 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86106.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86106" }, { "cve": "CVE-2026-86128", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause denial of service by sending a specially crafted IPv6 packet.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86128 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86128.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86128" }, { "cve": "CVE-2026-86131", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "other", "text": "Inclusion of Functionality from Untrusted Control Sphere", "title": "CWE-829" }, { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration enables a remote VPN server attacker to execute arbitrary root commands on the connecting Firebox device.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86131 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86131.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86131" }, { "cve": "CVE-2026-86132", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "description", "text": "An integer underflow vulnerability in WatchGuard Fireware OS IKEv2 daemon allows remote unauthenticated attackers to crash the process via a crafted encrypted IKEv2 message using AES-GCM cipher suite.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86132 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86132.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86132" }, { "cve": "CVE-2026-86133", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "description", "text": "An integer underflow vulnerability in WatchGuard Fireware OS IKE daemon allows remote attackers to crash the iked process and cause denial of service via a crafted encrypted IKEv2 message post-handshake.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86133 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86133.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86133" }, { "cve": "CVE-2026-86134", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A NULL pointer dereference vulnerability in WatchGuard Fireware OS's authentication process allows remote unauthenticated attackers to crash the management daemon via crafted login requests, resulting in denial of service.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86134 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86134.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86134" }, { "cve": "CVE-2026-86135", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "notes": [ { "category": "other", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "description", "text": "A CSRF vulnerability in WatchGuard Dimension allows remote attackers to trick authenticated administrators into creating unauthorized database snapshots via malicious web pages.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86135 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86135.json" } ], "title": "CVE-2026-86135" }, { "cve": "CVE-2026-86136", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86136 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86136.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86136" }, { "cve": "CVE-2026-86137", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "In libxml2 versions prior to 2.15.4, the xmlFAParsePosCharGroup function contains an out-of-bounds read vulnerability related to the NXT macro in xmlregexp, which can cause denial of service via specially crafted XML input.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86137 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86137.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 2.9, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-86137" }, { "cve": "CVE-2026-90441", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90441 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90441.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-90441" } ] }