Table of Contents
Is my network exposed to the new Fireware OS remote authentication exploit?
Network administrators managing WatchGuard Firebox appliances must prioritize an immediate firmware update. A critical security gap, tracked as CVE-2026-1498, exposes your network directory services to unauthorized external access. This vulnerability affects the Fireware OS and requires patching to prevent data exfiltration or unauthorized network entry.
The Technical Threat: LDAP Injection Explained
This vulnerability targets the Lightweight Directory Access Protocol (LDAP), the system responsible for organizing and verifying user credentials. The flaw exists within the Firebox authentication logic.
Specifically, CVE-2026-1498 allows an unauthenticated attacker to inject malicious commands into the LDAP database through exposed web interfaces. This creates two distinct risks:
- Information Disclosure: Attackers can query and retrieve sensitive user data from your connected LDAP server without logging in.
- Authentication Bypass: If an attacker possesses a valid passphrase, they can manipulate the login process to authenticate using only a partial username.
Risk Assessment: High vs. Critical
Security assessments regarding the severity of this flaw vary based on the deployment environment. WatchGuard assigns a CVSS Base Score of 7.0 (High). However, the German Federal Office for Information Security (BSI) elevates this to a CVSS Score of 10/10 (Critical).
The BSI rating reflects the potential for remote exploitation. If your administration or authentication web interfaces are accessible via the public internet, you should treat this as a maximum-severity incident.
Remediation Strategy
WatchGuard released patches on January 29, 2026. Applying these updates is the only effective mitigation. You must upgrade your Fireware OS to the version corresponding to your specific hardware generation.
Required Firmware Versions:
- Version 2026.1 (Newest release branch)
- Version 12.11.7 (Maintenance release)
- Version 12.5.16 (Legacy support)
Affected Hardware and Software List
Verify your device model against the list below to determine the necessary update path.
Fireware OS 2025.1.x Branch:
- Models: T115-W, T125, T125-W, T145, T145-W, T185
- M-Series: M295, M395, M495, M595, M695
Fireware OS 12.x Branch:
- T-Series: T20, T25, T40, T45, T55, T70, T80, T85
- M-Series: M270, M290, M370, M390, M440, M470, M570, M590, M670, M690
- High Availability/Enterprise: M4600, M4800, M5600, M5800
- Virtual/Cloud: Firebox Cloud, Firebox NV5, FireboxV
Legacy Branch (OS 12.5.x):
- Models: T15, T35