CVE-2022-23176: WatchGuard Firebox and XTM Privilege Escalation Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 10.8% chance of exploitation in the next 30 days.

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

Affected products

• WatchGuard Fireware: from 12.0.0, before 12.1.3 (fixed in 12.1.3); from 12.2.0, before 12.5.7 (fixed in 12.5.7); version 12.1.3 only; version 12.5.7 only; version 12.7.2 only

Published 2022-02-24. Last modified 2026-06-17.