WatchGuard Firebox Out of Bounds Write Vulnerability
Out-of-bounds write in WatchGuard Fireware OS allows unauthenticated RCE via IKEv2 VPN. CVSS 9.8. Ransomware exploitation confirmed September 2026.
- Vendor
- WatchGuard
- Product
- Firebox
- CVSS
- 9.8
- EPSS (exploit probability)
- 26.5%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-14733 being exploited?
Yes. CISA added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 26.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-24. Full cross-catalog view: /kev-comparison
CVE-2025-14733 timeline
- Added to CISA KEVsame day as NVD
- Published to NVD
- First 0dayNews coverage+266d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (7 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2025-14733 is an out-of-bounds write in the iked process in WatchGuard’s Fireware OS. An unauthenticated remote attacker can trigger the flaw through IKEv2 VPN sessions: both mobile user VPN connections using IKEv2 and branch office VPN tunnels configured with a dynamic gateway peer are affected. Successful exploitation allows arbitrary code execution on the appliance.
CVSS 9.8 Critical. No authentication required, no user interaction needed.
WatchGuard disclosed the vulnerability and released patched firmware in December 2025. CISA added CVE-2025-14733 to the Known Exploited Vulnerabilities catalog on December 19, 2025, with a federal patch deadline of December 26. On September 10, 2026, CISA updated the KEV entry to confirm ransomware groups are actively exploiting it. Approximately 9,000 Firebox appliances remained publicly accessible with unpatched firmware at that point.
Affected versions:
- Fireware OS 11.x through 11.12.4_Update1
- Fireware OS 12.x through 12.11.5
- Fireware OS 2025.1 through 2025.1.3
What to do: Apply the fixed Fireware OS build listed in the WatchGuard PSIRT advisory. If patching cannot happen immediately, remove the appliance from public internet exposure until the update is applied. The NVD record and CISA KEV catalog are the primary references for patch status.
Other WatchGuard CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-9242 WatchGuard Firebox Out-of-Bounds Write Vulnerability | [ CRITICAL ] | 9.8 | 91.8% | |
| CVE-2022-23176 WatchGuard Firebox and XTM Privilege Escalation Vulnerability | [ HIGH ] | 8.8 | 10.8% | |
| CVE-2022-26318 WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | [ CRITICAL ] | 9.8 | 78.2% |
