CISA: WatchGuard Firebox Bug Hits Ransomware List [2026] | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

The U.S. Cybersecurity and Infrastructure Security Agency confirmed this week that ransomware gangs are now exploiting a critical WatchGuard Firebox firewall vulnerability, a flaw that has sat on the agency’s Known Exploited Vulnerabilities catalog since December 2025. The update, reported first by BleepingComputer, arrived in a routine Thursday KEV catalog refresh that flipped the entry’s ransomware status from “Unknown” to “Known” without an accompanying press release or technical bulletin. CISA has not named the ransomware group or gangs involved, nor disclosed how many organizations have been hit.

The vulnerability, tracked as CVE-2025-14733, sits in the Fireware OS iked process that WatchGuard Firebox appliances use to handle IKEv2-based VPN connections. It is a textbook perimeter-device bug: no authentication needed, no user interaction required, and a direct path to arbitrary code execution on a device that sits at the edge of a corporate network, exactly where a ransomware operator wants a foothold. The gap between CISA’s original KEV listing and today’s ransomware confirmation is 265 days, a span security researchers say illustrates a much bigger problem than any single flaw: enterprises are still running exposed, unpatched edge devices for months after the government tells them exploitation is happening.

What CVE-2025-14733 actually does

According to the National Vulnerability Database entry for CVE-2025-14733, the flaw is an out-of-bounds write (CWE-787) in the Fireware OS iked process. NVD’s description states plainly that the bug “may allow a remote unauthenticated attacker to execute arbitrary code.” The vulnerable code path runs through two specific VPN features: Mobile User VPN with IKEv2, and Branch Office VPN using IKEv2, but only when either is configured with a dynamic gateway peer. That configuration detail matters: it narrows the blast radius somewhat, but dynamic-peer IKEv2 setups are common in distributed offices and remote-access deployments, which is exactly the population WatchGuard sells Firebox hardware into.

WatchGuard’s own severity rating puts the bug at roughly 9.3 under the newer CVSS 4.0 scoring framework and close to 9.8 under the older CVSS 3.x scale, both firmly in the critical band. An out-of-bounds write in a network-facing VPN daemon is about as dangerous as firewall vulnerabilities get, because the iked process by definition has to accept untrusted traffic from the internet before authentication happens. Memory corruption bugs in that kind of code let an attacker skip past every access control the firewall is supposed to enforce.

The affected version list is wide. Fireware OS builds in the 11.x branch (including 11.12.4_Update1), the 12.x branch (including 12.11.5), and the 2025.1 through 2025.1.3 releases are all listed as vulnerable. WatchGuard has shipped patched builds for supported branches, and the company’s advisory guidance, published through its security notices page, points customers toward updated Fireware releases or interim mitigations for devices that cannot be patched immediately.

The 265-day gap between KEV listing and ransomware confirmation

CISA first added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog on December 19, 2025, with a remediation due date of December 26, 2025, one week later, as required under Binding Operational Directive 22-01 for federal civilian agencies. At that point, the KEV entry’s known-ransomware-campaign-use field was marked “Unknown,” meaning CISA had evidence of active exploitation but no confirmed tie to ransomware operators. That changed in the September 9-10, 2026 update BleepingComputer reported on, when the field was quietly switched to “Known.”

The KEV catalog’s required-action language for this entry is unambiguous: agencies must apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. That is the standard formula CISA uses across every KEV entry, but it carries extra weight here because the flaw has now been sitting exploitable, and known to be exploitable, for the better part of a year.

BleepingComputer’s reporting on the flag change is blunt about what it means for defenders still running exposed Fireboxes: CVE-2025-14733 was already known to be exploited months ago, yet thousands of vulnerable Fireboxes remain exposed to the public internet. CISA has not detailed how it confirmed the ransomware linkage, what strain or strains of ransomware are involved, or which sectors have been hit. That silence is consistent with how CISA typically handles these updates: the KEV catalog is a compliance instrument aimed at federal agencies first, and outside of the due-date field, it rarely doubles as an incident report.

Why the ransomware-status flip matters more than a new CVE

A KEV listing on its own tells defenders that a nation-state actor, a criminal group, or an opportunistic scanner has weaponized a bug somewhere in the wild. A ransomware flag flip tells them something more specific: this vulnerability has become a reliable initial-access technique for extortion operators, the group of attackers most likely to escalate a single compromised firewall into a full domain takeover and a seven-figure ransom demand. Firewalls, VPN concentrators, and other edge appliances have become the preferred entry point for ransomware crews precisely because they sit outside the reach of endpoint detection tools and often run for years without a reboot or a firmware check.

This is not an isolated pattern. CISA’s KEV catalog contains a growing subset of entries where the ransomware field was updated well after the initial listing, sometimes by a single day and sometimes by well over a thousand days. Analysis of CISA’s own catalog changes found that in 2025 alone, the agency quietly updated the ransomware flag on 59 vulnerabilities, with gaps ranging from one day to more than 1,300 days between the original KEV addition and the ransomware confirmation, and with no public announcement accompanying any single change. WatchGuard’s 265-day gap sits roughly in the middle of that range, not the worst case CISA has recorded, but far from reassuring for organizations that assumed a KEV listing without a ransomware flag was lower priority.

A crowded month for firewall and edge-device KEV entries

WatchGuard’s ransomware confirmation landed in the same stretch of weeks that CISA flagged ransomware exploitation of a separate critical VMware vCenter vulnerability, patched in July, and a maximum-severity GitLab flaw under active attack. It also follows a summer in which SonicWall’s SMA1000 appliance line was hit twice: first with CVE-2026-15409, a pre-authentication server-side request forgery bug rated CVSS 10.0 and added to KEV on July 14, 2026 with a three-day federal deadline, alongside the lower-severity CVE-2026-15410 path-traversal bug rated 7.2, and then again in early September 2026 with a fresh pair of zero-days, CVE-2026-83548 and CVE-2026-83549, affecting SMA1000 models 6210, 7210, and 8200v, added to KEV on September 2 with a remediation deadline of September 5.

Other 2026 ransomware-linked KEV additions include a Microsoft SharePoint remote code execution bug patched during a record Patch Tuesday update, CVE-2026-45659, which CISA confirmed as ransomware-exploited in August after tracking active exploitation since early July, and a Windows Defender privilege-escalation flaw researchers have referred to internally as BlueHammer, which CISA flagged as ransomware-linked on June 30 after adding it to KEV back in April. Separately, a critical Cisco Firepower Management Center bug exposed hundreds of internet-facing boxes to similar risk earlier this year, and a cPanel authentication-bypass bug, CVE-2026-41940, rated CVSS 9.8, has reportedly been used in ransomware campaigns since February 2026. Taken together, the pattern is one of steadily accumulating edge-facing and internet-facing software flaws that ransomware crews treat as a rotating menu of entry points, patched by vendors on one timeline and weaponized by criminals on another, entirely disconnected timeline.

WatchGuard Firebox vulnerability at a glance

2026 ransomware-linked KEV additions, compared

Exposure: why “thousands of Fireboxes” is the number that matters

Neither WatchGuard nor CISA has published a precise count of internet-exposed Firebox devices still running vulnerable Fireware builds. BleepingComputer’s reporting describes the exposed population only as “thousands,” a figure consistent with how firewall appliance vulnerabilities tend to play out: patches ship, a meaningful share of the installed base updates within weeks, and a long tail of smaller organizations, managed-service-provider clients, and branch offices with limited IT staff never gets around to it. That long tail is exactly where ransomware operators concentrate their scanning, because it is also where detection and incident response capability tends to be thinnest.

The dynamic-gateway-peer configuration requirement narrows the exposed population somewhat compared to a fully unauthenticated, no-configuration-needed bug, but it does not narrow it enough to matter for risk planning. Dynamic peer IKEv2 setups are the default choice for any organization connecting mobile or remote-access clients to a Firebox, which is a large share of WatchGuard’s customer base by design. Firewall vendors sell Firebox appliances specifically to distributed businesses, retail chains, and mid-market companies that need VPN connectivity without a dedicated network engineering team, the same demographic least likely to have automated patch management in place for perimeter hardware.

How this compares to other 2026 firewall exploitation waves

2026 has been a difficult year for perimeter security vendors generally. SonicWall’s SMA1000 line, aimed at the same mid-market remote-access use case as WatchGuard Firebox, was hit with two separate ransomware-linked KEV listings within the space of about seven weeks, first the CVSS 10.0 server-side request forgery bug in mid-July and then a fresh pair of zero-days affecting specific SMA1000 hardware models in early September. Cisco, Adobe, and Microsoft continue to accumulate the largest raw counts of KEV-listed vulnerabilities of any vendor tracked, with Microsoft alone linked to 388 actively exploited CVEs and 117 confirmed ransomware-linked entries as of early September 2026, according to vulnerability-tracking site Senserva’s KEV analysis. Cisco’s KEV count sits at 97 with 7 ransomware-linked entries, and Adobe’s at 81 with 11 ransomware-linked entries over the same period.

What separates the WatchGuard case from most of those is the length of the delay between the original listing and the ransomware confirmation. A SonicWall bug getting flagged as ransomware-linked at the same moment it lands on the KEV catalog gives defenders a clean, urgent signal to act immediately. A WatchGuard bug that sat quietly for 265 days before the ransomware flag appeared sends a murkier signal: organizations that patched promptly in December, when the bug was merely critical and actively exploited, were protected the entire time regardless of the later ransomware flag change. Organizations that deferred patching because the bug had not yet been tied to ransomware were exposed to exactly the risk that materialized nine months later.

What security teams should do now

The immediate action for any organization running WatchGuard Firebox appliances is straightforward: confirm the installed Fireware OS build against WatchGuard’s patched-version guidance, apply the update if it has not already been applied, and audit whether Mobile User VPN or Branch Office VPN configurations use a dynamic gateway peer. For appliances that cannot be patched immediately, WatchGuard’s security notices describe interim mitigations, and CISA’s KEV entry explicitly authorizes discontinuing use of the product where mitigation is not possible, language federal agencies are required to follow and private-sector organizations would do well to treat as a floor, not a ceiling.

Beyond the immediate patch, the broader lesson from the 265-day gap is about how security teams triage KEV entries in the first place. A known-exploited listing without a ransomware flag is not a green light to deprioritize a patch. CISA’s own catalog history, including this WatchGuard case, its first-ever addition of an MCP flaw earlier this year, and the 59 other vulnerabilities whose ransomware status changed quietly in 2025, shows that the ransomware field is a lagging indicator, not a leading one. By the time CISA confirms ransomware use, the exploitation campaign behind that confirmation has typically been running for months. Broader coverage of the threat landscape driving these decisions is tracked on our cybersecurity threats hub.

Historical context: firewalls as the new ransomware front door

The shift toward firewall and VPN appliances as primary ransomware entry points has been building for several years, part of a broader trend documented in 2026 ransomware trend data showing attack volume rising even as payment rates fall. Earlier generations of ransomware campaigns relied heavily on phishing emails and exposed remote desktop protocol services to gain initial access. As endpoint detection and response tools improved and email filtering matured, ransomware affiliates increasingly turned to network appliances that traditional endpoint security tools cannot see or instrument. A firewall’s iked process, VPN gateway, or management interface runs as a black box from the perspective of most enterprise security stacks, which makes a single unpatched CVE in that black box disproportionately valuable to an attacker compared to an equivalent bug in a desktop operating system.

WatchGuard, SonicWall, and other mid-market firewall vendors sit at a specific intersection of risk: their customers are large enough in aggregate to be attractive ransomware targets, but individually too small to run the kind of dedicated vulnerability management programs that track every KEV update the day it posts. That gap between vendor patch availability and customer patch adoption is the space ransomware operators have learned to exploit systematically, treating it as a predictable, months-long window rather than a narrow zero-day sprint.

Predictions: where this goes from here

Based on the pattern established by CVE-2025-14733 and comparable 2026 KEV entries, several trends look likely to continue through the rest of the year. First, expect more quiet ransomware-flag updates on older KEV entries rather than a slowdown, as CISA continues reconciling its catalog against intelligence gathered well after the original listing date. Second, mid-market firewall and VPN appliance vendors, not just the largest cloud and OS vendors, will keep contributing a disproportionate share of ransomware-linked KEV entries, because their customer base skews toward organizations with weaker patch cadences. Third, expect continued pressure on CISA to publish more detail alongside ransomware-flag changes, given the criticism BleepingComputer’s reporting and independent researchers have directed at the lack of accompanying technical detail. Fourth, WatchGuard and similar vendors are likely to face renewed scrutiny over how quickly they notify customers when a previously merely-critical bug gains a ransomware designation, an area where vendor communication has generally lagged CISA’s own catalog updates. Fifth, expect the gap between initial KEV listing and ransomware confirmation to become a tracked metric in its own right among vulnerability management vendors, since the WatchGuard case and the broader 59-vulnerability pattern from 2025 suggest it is now common enough to warrant its own risk scoring.

Frequently asked questions

What is CVE-2025-14733?
It is a critical out-of-bounds write vulnerability in the Fireware OS iked process used by WatchGuard Firebox firewalls, allowing a remote, unauthenticated attacker to execute arbitrary code when Mobile User VPN or Branch Office VPN is configured with a dynamic gateway peer, according to the NVD entry for the flaw.

Is CVE-2025-14733 being exploited by ransomware gangs?
Yes. CISA updated its Known Exploited Vulnerabilities catalog in a September 9-10, 2026 refresh to mark the flaw’s ransomware-campaign-use field as “Known,” having listed it as actively exploited, without a confirmed ransomware link, since December 19, 2025.

Which WatchGuard Firebox versions are affected?
Fireware OS builds in the 11.x branch (including 11.12.4_Update1), the 12.x branch (including 12.11.5), and the 2025.1 through 2025.1.3 releases are listed as vulnerable. Organizations should check WatchGuard’s security notices for the specific patched build for their branch.

Has CISA named the ransomware gang behind the exploitation?
No. CISA’s KEV catalog update confirmed ransomware use of the flaw but, per BleepingComputer’s reporting, has not provided additional details about the specific gang, victims, or attack techniques involved.

How many WatchGuard Firebox devices are still vulnerable?
Neither WatchGuard nor CISA has published an exact figure. BleepingComputer’s reporting describes the exposed population only as “thousands” of vulnerable Fireboxes still reachable from the public internet as of September 2026.

What should organizations running Firebox appliances do?
Confirm the installed Fireware OS version, apply WatchGuard’s patched release for that branch, review whether VPN configurations use a dynamic gateway peer, and apply the interim mitigations described in WatchGuard’s security notices for any appliance that cannot be updated immediately.

Why did it take 265 days for the ransomware link to be confirmed?
CISA has not explained its process for confirming ransomware-campaign use on individual KEV entries. Independent analysis of the catalog has found the ransomware flag on other vulnerabilities has been updated anywhere from one day to more than 1,300 days after the original listing, suggesting the delay reflects how CISA gathers and verifies exploitation intelligence rather than a fixed review timeline.

Is this the same vulnerability as the VMware vCenter flaw CISA also flagged this month?
No. The WatchGuard Firebox flaw, CVE-2025-14733, is a separate vulnerability in a different vendor’s product. It surfaced in the same general period that CISA also confirmed ransomware exploitation of an unrelated critical VMware vCenter vulnerability patched in July 2026.

Related Coverage