WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE
WatchGuard Technologies released security updates on August 27, 2026, for its Firebox firewall products running Fireware OS. The updates address 11 vulnerabilities and the vendor is urging customers to apply the fixes without delay.
The company published three new Fireware releases: Fireware 2026.2.2, 12.12.2, and 12.5.20. Nine of the eleven issues reside in the IKE daemon (iked) responsible for Internet Key Exchange processing. Crafted IKE messages can trigger buffer overflows, out-of-bounds memory reads, and double-free conditions.
The most severe flaws are tracked as CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318. These vulnerabilities can result in denial of service through memory corruption and, in some cases, unauthenticated remote code execution. CVE-2026-19318 only affects systems where the IKE payload diagnostic log feature is enabled.
Separately, CVE-2026-13086 exists in the deprecated Mobile Security epm service. An adjacent-network attacker who can reach a trusted interface may execute arbitrary code with root privileges without authentication.
WatchGuard has published individual advisories for each CVE and strongly recommends that all customers upgrade to the latest Fireware versions immediately.
Related articles
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.