CVE-2022-26318

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-26318 is an unauthenticated remote code execution vulnerability affecting WatchGuard Firebox and XTM appliances running Fireware OS versions prior to 12.7.2_U2, 12.1.3_U8, and 12.5.9_U2. The flaw permits an attacker to execute arbitrary code on the device without requiring credentials or user interaction, reflected in its CVSS 3.1 base score of 9.8.

An unauthenticated remote attacker can exploit the issue over the network to achieve full compromise of the appliance, including the ability to read, modify, or delete data and to alter device behavior. Because the attack requires no authentication or special preconditions, it can be launched from anywhere with network reachability to the management or exposed interfaces.

WatchGuard’s Fireware 12.7.2 release notes list the issue as resolved under FBX-22786 and direct customers to upgrade to the fixed builds. CISA has added CVE-2022-26318 to its Known Exploited Vulnerabilities catalog, confirming that the flaw has been observed in active exploitation campaigns.

The EPSS score remains consistently high near 0.93, indicating sustained exploitation interest after public disclosure.