Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-13728

WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WatchGuard

Description

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WatchGuard Fireware OS

Default version status: unaffected

  • 2025.1 to < 2026.2.1affected
  • 12.0 to < 12.12.1affected

WatchGuard Fireware OS

Default version status: unaffected

  • 12.0 to < 12.11.9affected

References