CVE-2026-13728

WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database

Medium 5.9 CVSS v4.0 › Published 2026-07-02Updated 2026-08-27

Summary #

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources.

This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

Product status #

ProductAffectedNot affected
Fireware OS
Default >= 2025.1, < 2026.2.1, >= 12.0, < 12.12.1>= 2026.2.1, >= 12.12.1
EUCC >= 12.0, < 12.11.9>= 12.11.9

Weakness Type and Impact #

  • CWECWE-798Use of Hard-coded Credentials
  • CAPECCAPEC-37Retrieve Embedded Sensitive Data

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.11.9

References #

Credits #

  • Cody Sixteenfinder