WatchGuard Firebox Out of Bounds Write Vulnerability
Out-of-bounds write in WatchGuard Fireware OS allows unauthenticated RCE via IKEv2 VPN. CVSS 9.8. Ransomware exploitation confirmed September 2026.
- Vendor
- WatchGuard
- Product
- Firebox
- CVSS
- 9.8
- EPSS (exploit probability)
- 26.5%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
CVE-2025-14733 is an out-of-bounds write in the iked process in WatchGuard’s Fireware OS. An unauthenticated remote attacker can trigger the flaw through IKEv2 VPN sessions: both mobile user VPN connections using IKEv2 and branch office VPN tunnels configured with a dynamic gateway peer are affected. Successful exploitation allows arbitrary code execution on the appliance.
CVSS 9.8 Critical. No authentication required, no user interaction needed.
WatchGuard disclosed the vulnerability and released patched firmware in December 2025. CISA added CVE-2025-14733 to the Known Exploited Vulnerabilities catalog on December 19, 2025, with a federal patch deadline of December 26. On September 10, 2026, CISA updated the KEV entry to confirm ransomware groups are actively exploiting it. Approximately 9,000 Firebox appliances remained publicly accessible with unpatched firmware at that point.
Affected versions:
- Fireware OS 11.x through 11.12.4_Update1
- Fireware OS 12.x through 12.11.5
- Fireware OS 2025.1 through 2025.1.3
What to do: Apply the fixed Fireware OS build listed in the WatchGuard PSIRT advisory. If patching cannot happen immediately, remove the appliance from public internet exposure until the update is applied. The NVD record and CISA KEV catalog are the primary references for patch status.
