WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE
WatchGuard Technologies released security updates on August 27, 2026, for its Firebox firewall products running Fireware OS. The updates address 11 vulnerabilities and the vendor is urging customers to apply the fixes without delay.
The company published three new Fireware releases: Fireware 2026.2.2, 12.12.2, and 12.5.20. Nine of the eleven issues reside in the IKE daemon (iked) responsible for Internet Key Exchange processing. Crafted IKE messages can trigger buffer overflows, out-of-bounds memory reads, and double-free conditions.
The most severe flaws are tracked as CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318. These vulnerabilities can result in denial of service through memory corruption and, in some cases, unauthenticated remote code execution. CVE-2026-19318 only affects systems where the IKE payload diagnostic log feature is enabled.
Separately, CVE-2026-13086 exists in the deprecated Mobile Security epm service. An adjacent-network attacker who can reach a trusted interface may execute arbitrary code with root privileges without authentication.
WatchGuard has published individual advisories for each CVE and strongly recommends that all customers upgrade to the latest Fireware versions immediately.
Related articles
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A security researcher known as grizzzer detailed a full attack chain that resulted in defacing the authorization page of the First Partner Bank digital banking service inside the Standoff 365 online polygon. The demonstration began with a successful DNS zone transfer against the fpb.stf domain, revealing the dbo.fpb.stf host that hosted the target application. After identifying the Node.js, Express, and React stack, the researcher discovered that the receipt generation endpoint accepted an undocumented pretty parameter that was passed directly into the Pug template engine. This led to a server-side template injection vulnerability that was escalated to a Node.js reverse shell. With code execution, the attacker located and modified the translation.json localization file, replacing the welcome message with the string pwned by VON visible to all users. The write-up concludes with concrete hardening recommendations including disabling zone transfers, avoiding direct spread of req.query into templates, and restricting outbound connections.
Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error
A Telegram Desktop update introduced a critical flaw that caused the application to recursively delete user folders containing up to 800 GB of data on Windows systems. The root cause traced back to an incorrect path construction for the custom dictionary file used by the lib_spellcheck library when Windows native spell checking was enabled. Due to a misplaced return statement in the code, the working directory path remained empty, leading Qt to interpret the path as the root-level C:\custom folder. The application then invoked QDir::removeRecursively on this directory, removing all accessible files while skipping locked ones. The bug affected releases 7.1.0 and 7.1.1 for approximately 66 hours before being fixed in version 7.1.2. Researchers used Process Monitor to confirm Telegram.exe was directly responsible for the deletion attempts. The incident highlights risks of combining recursive deletion functions with unvalidated path inputs in widely used applications.
CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026
CISA has placed CVE-2026-8452 in its Known Exploited Vulnerabilities catalog, compelling US federal agencies to apply patches to Citrix NetScaler before the unusually tight deadline of August 29 2026. The flaw, initially reported as a memory overflow leading to denial of service, has been confirmed through public technical analysis to enable unauthenticated remote code execution with root privileges on unpatched devices. The vulnerability impacts NetScaler ADC and NetScaler Gateway appliances configured as VPN Gateway or AAA virtual servers, with heightened risk in SAML-based deployments acting as either Service Provider or Identity Provider. Attackers have already conducted spray-and-pray campaigns that deploy webshells and perform basic reconnaissance after initial compromise. Tens of thousands of NetScaler instances remain internet-exposed, increasing the likelihood of automated mass exploitation. Citrix has released fixed builds including 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP environments. Organizations are advised to inventory exposed devices, verify versions, hunt for indicators of compromise, and apply additional hardening measures beyond patching.
CISA Orders Federal Agencies to Patch Critical Citrix NetScaler RCE Flaw by August 29 2026
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and set an unusually tight deadline for U.S. federal agencies to remediate the issue in Citrix NetScaler products. The vulnerability, initially described as a denial-of-service condition, is now actively exploited to achieve unauthenticated remote code execution with root privileges on unpatched appliances. Affected configurations include NetScaler ADC and NetScaler Gateway when deployed as VPN Gateway or AAA virtual servers, especially in environments using SAML for single sign-on. Attackers have been observed deploying webshells and performing reconnaissance after initial compromise in a spray-and-pray pattern. Tens of thousands of NetScaler devices remain exposed to the internet, increasing the risk of widespread automated attacks. Citrix has released fixed builds including 14.1-72.61 and 13.1-63.18, along with specific versions for FIPS and NDcPP environments.