CISA flags WatchGuard Firebox RCE in ransomware use

CISA updated its Known Exploited Vulnerabilities catalog so CVE-2025-14733, a WatchGuard Firebox remote code execution bug, is now marked as used in ransomware campaigns. BleepingComputer reported the catalog field change on 10 September 2026, not a fresh WatchGuard disclosure.

The CVE was disclosed and first listed in December 2025. CISA first added it on 19 December 2025 with a 26 December federal due date under BOD 22-01. The September update sets ransomware campaign use to Known. CISA did not name the families or publish victim counts in the update BleepingComputer describes.

The bug is an out-of-bounds write in the Fireware OS iked process that allows unauthenticated remote code execution at low complexity. WatchGuard advisory WGSA-2025-00027 remains the patch source. Affected Fireware lines run through 11.12.4_Update1, 12.11.5, and 2025.1 through 2025.1.3. Fixed floors are 11.12.4_Update2 and later, 12.11.6 and later, and 2025.1.4 and later, plus the matching T15/T35 branch (12.5.15 and later on WatchGuard's table).

The attack path is IKEv2: Mobile User VPN with IKEv2, and Branch Office VPN with a dynamic gateway peer. WatchGuard warned that a device can stay at risk if a branch office VPN to a static gateway peer remains, even after the vulnerable configs were deleted.

Shadowserver, as cited by BleepingComputer, found over 115,000 unpatched Fireboxes on the internet in December. Nearly 9,000 were still exposed after nine months. WatchGuard, in the same report, serves more than 250,000 SMBs through more than 17,000 resellers. The same KEV catalog already carries Cisco Secure FMC under active attack and CISA's ownCloud, Linux, and Artifactory batch.

Some offers on this page may be paid placements or contain affiliate links.