CVE-2026-13728

Summary

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources.

This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

Affected Software

VendorProductVersion RangeStatus
WatchGuardFireware OS2025.1 < 2026.2.1affected
WatchGuardFireware OS12.0 < 12.12.1affected

Weaknesses

  • CWE-798: CWE-798

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References