CVE-2022-26318: WatchGuard Fireware RCE Vulnerability

CVE-2022-26318 Overview

CVE-2022-26318 is a remote code execution vulnerability affecting WatchGuard Firebox and XTM network security appliances running Fireware OS. The flaw, tracked internally by WatchGuard as FBX-22786, allows an unauthenticated remote attacker to execute arbitrary code on the appliance over the network. The vulnerability impacts Fireware OS versions before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS score of 92.547% places this CVE in the 99.747 percentile for likelihood of exploitation.

Critical Impact
Unauthenticated attackers can remotely execute arbitrary code on perimeter firewall devices, enabling full appliance compromise and pivoting into protected networks.

Affected Products

WatchGuard Fireware OS versions before 12.7.2_U2
WatchGuard Fireware OS 12.x before 12.1.3_U8
WatchGuard Fireware OS 12.2.x through 12.5.x before 12.5.9_U2

Discovery Timeline

2022-03-04 - CVE-2022-26318 published to the National Vulnerability Database
2025-11-13 - Last updated in NVD database

Technical Details for CVE-2022-26318

Vulnerability Analysis

CVE-2022-26318 is an unauthenticated remote code execution vulnerability in the Fireware OS that powers WatchGuard Firebox and XTM firewall appliances. The vulnerability is reachable over the network without any prior authentication or user interaction. Successful exploitation grants the attacker arbitrary code execution in the context of the firewall service. Because the affected systems are perimeter network devices, a compromise gives the attacker a privileged foothold between the internet and protected internal networks.

CISA's inclusion of CVE-2022-26318 in the Known Exploited Vulnerabilities catalog confirms that threat actors have weaponized this flaw against production environments. The vulnerability has been linked publicly to activity associated with the Cyclops Blink botnet, which targeted WatchGuard appliances at scale.

Root Cause

WatchGuard has not published detailed technical root-cause information. The advisory describes the issue as an unauthenticated arbitrary code execution defect in Fireware OS, tracked internally as FBX-22786. The CWE classification in NVD is recorded as NVD-CWE-Other. Refer to the WatchGuard Fireware Release Notes for vendor remediation details.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the management or service interfaces of a vulnerable Firebox or XTM appliance can deliver a crafted request that triggers arbitrary code execution. Public reporting on Cyclops Blink indicates that exploitation has been used to deploy persistent firmware-resident implants on compromised appliances.

No verified public proof-of-concept code is referenced in the enriched data. See the CISA Known Exploited Vulnerabilities entry for additional context on confirmed exploitation.

Detection Methods for CVE-2022-26318

Indicators of Compromise

Unexpected outbound connections from Firebox or XTM appliances to unknown command-and-control infrastructure, consistent with Cyclops Blink activity.
Unauthorized configuration changes, new administrative accounts, or modified firmware images on Fireware appliances.
Anomalous process activity or persistence artifacts surviving device reboots and firmware updates.

Detection Strategies

Inventory all WatchGuard Firebox and XTM devices and verify Fireware OS version against the fixed releases 12.7.2_U2, 12.1.3_U8, and 12.5.9_U2.
Inspect appliance logs for unauthenticated access attempts to management interfaces and unusual administrative actions.
Correlate firewall telemetry with internal SIEM and network flow data to identify lateral movement originating from the appliance.

Monitoring Recommendations

Restrict management plane exposure and continuously monitor for inbound connections to Firebox or XTM management ports from untrusted networks.
Alert on Fireware appliances initiating outbound connections to non-standard destinations or on non-business ports.
Apply WatchGuard's published Cyclops Blink detection and remediation tooling and verify integrity of firmware after patching.

How to Mitigate CVE-2022-26318

Immediate Actions Required

Upgrade Fireware OS to 12.7.2_U2, 12.1.3_U8, or 12.5.9_U2 or later as appropriate for the deployed branch.
Restrict access to the appliance management interface to trusted administrative networks only, and disable internet-facing management where possible.
Rotate all administrative credentials, API keys, and certificates on affected appliances after patching.
Follow WatchGuard's Cyclops Blink remediation guidance to validate that no persistent implant remains on the device.

Patch Information

WatchGuard addressed CVE-2022-26318 in Fireware OS releases 12.7.2_U2, 12.1.3_U8, and 12.5.9_U2. Refer to the WatchGuard Fireware 12.7.2 Release Notes for the resolved issues list including FBX-22786 and upgrade instructions. Federal agencies and KEV-aligned organizations should prioritize remediation in line with CISA KEV guidance.

Workarounds

Block all untrusted source addresses from reaching the appliance management interfaces using upstream access controls.
Place Firebox and XTM management on isolated, out-of-band networks accessible only through jump hosts with multi-factor authentication.
If immediate patching is not possible, take affected devices offline until Fireware OS can be upgraded to a fixed version.

bash

# Configuration example - verify Fireware OS version against fixed releases
# From WatchGuard CLI:
show system info | grep -i version

# Confirm version is one of:
#   12.7.2_U2 or later (12.7.x branch)
#   12.5.9_U2 or later (12.2.x - 12.5.x branch)
#   12.1.3_U8 or later (12.1.x branch)