{"id":"CVE-2022-26318","aliases":["EUVD-2022-30879","GHSA-vvw7-v96v-gmxr"],"status":"published","title":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka...","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.78157,"percentile":0.9958,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-122"],"published":"2022-03-04T17:36:37Z","modified":"2026-06-17T04:34:58Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"pocgithub","id":"misterxid/watchguard_cve-2022-26318","title":"misterxid/watchguard_cve-2022-26318","date":"2022-03-28","url":"https://github.com/misterxid/watchguard_cve-2022-26318"},{"source":"pocgithub","id":"h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318","title":"h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318","date":"2022-04-18","url":"https://github.com/h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318"},{"source":"pocgithub","id":"BabyTeam1024/CVE-2022-26318","title":"BabyTeam1024/CVE-2022-26318","date":"2022-05-21","url":"https://github.com/BabyTeam1024/CVE-2022-26318"},{"source":"metasploit","id":"exploit/linux/http/watchguard_firebox_unauth_rce_cve_2022_26318","title":"WatchGuard XTM Firebox Unauthenticated Remote Command Execution","type":"exploit","platform":"Unix","date":"2022-08-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/watchguard_firebox_unauth_rce_cve_2022_26318"},{"source":"pocgithub","id":"egilas/Watchguard-RCE-POC-CVE-2022-26318","title":"egilas/Watchguard-RCE-POC-CVE-2022-26318","date":"2024-12-05","url":"https://github.com/egilas/Watchguard-RCE-POC-CVE-2022-26318"}],"products":[{"vendor":"watchguard","product":"firebox and xtm appliances"},{"vendor":"watchguard","product":"fireware"}],"references":[{"url":"https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26318","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26318"},{"url":"https://github.com/advisories/GHSA-vvw7-v96v-gmxr"}],"sources":{"cve":[{"id":"CVE-2022-26318","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.","status":"published","published":"2022-03-04T17:36:37Z","modified":"2025-10-21T23:15:44.814Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-30879","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.","status":"published","published":"2022-03-04T17:36:37Z","modified":"2025-10-21T23:15:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-vvw7-v96v-gmxr","title":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka...","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.","status":"published","published":"2022-03-05T00:00:43Z","modified":"2025-10-22T00:32:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2022-26318","title":"WatchGuard Firebox and XTM Appliances Arbitrary Code Execution","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.","cwes":["CWE-122"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2022-26318","description":"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.","status":"published","published":"2022-03-04T18:15:08.367Z","modified":"2026-06-17T04:34:58.11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:12.711288Z"}]}}