WatchGuard Fireware OS: XPath injection in SSH authentication
Summary
An XPath injection in the SSH authentication process of WatchGuard Fireware OS, the firmware of Firebox firewall appliances, allows an attacker to extract sensitive configuration data. The attacker must be able to reach the management SSH interface, and the CNA record describes the attack as possible without authentication. Successful exploitation exposes configuration secrets, while integrity and availability are not rated as affected.
Affected
- Fireware OS 12.0 to before 12.5.22
- Fireware OS 2025.1 to before 2026.4
- Fireware OS 12.0 to before 12.12.4
- Affected only where the management SSH interface is reachable by an attacker
Fixed in
- Fireware OS 12.5.22
- Fireware OS 2026.4
- Fireware OS 12.12.4
Workaround
- Unknown.
- Restrict management SSH access to trusted admin networks or VPN until patched.
- Disable management SSH where it is not needed.
Exploitation
- WatchGuard is not aware of any exploitation in the wild.
- No public proof-of-concept confirmed; VulDB reports no available exploit.
- Not listed in CISA KEV.
- EPSS: 0.46 % (percentile 40), not independently verified.
Our recommendation
- Identify all Firebox devices and their Fireware versions.
- Upgrade to 12.5.22, 2026.4 or 12.12.4, depending on the branch.
- Until patched, limit management SSH to trusted admin networks and disable it where not needed.
- Check the WatchGuard advisory for updated details, as the NVD record is still awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-93434 psirt.watchguard.com
- SecurityOnline: WatchGuard Fireware OS vulnerabilities securityonline.info
- VulDB CVE-2026-93434 vuldb.com
- CVE threatint record CVE-2026-93434 cve.threatint.com
- OffSeq threat radar CVE-2026-93434 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:55.
Original description (NVD)
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.