What’s Vulnerable › Vulnerabilities

CVE-2026-1498: WatchGuard Firebox LDAP Injection

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-30 · updated 2026-08-10
• Weakness: CWE-90

Description

An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.

Affected products

• WatchGuard Fireware OS: from 2025.1 before 2026.1; from 12.0 before 12.11.7; from 12.0 before 12.5.16 — fixed in 12.11.7, 12.5.16, 2026.1

How to fix

Upgrade to a fixed version: WatchGuard Fireware OS 12.11.7, 12.5.16, 2026.1. Check the vendor advisory for mitigations.

References

• https://psirt.watchguard.com/CVE-2026-1498
• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00001

Get alerted when CVE-2026-1498 or the next vulnerability affects your stack