CVE-2026-13053

HighCVSS 7.2/10Last modified Oct 25, 2026

Description

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.1, < 2026.2.1; >= 12.0, < 12.12.1; >= 11.0, < *
WatchGuard	Fireware OS	>= 12.0, < 12.11.9
WatchGuard	Fireware OS	>= 12.0, < 12.5.19

References

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-130547.2A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary CVE-2026-130556.5The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fai CVE-2026-130566.5Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing CVE-2026-130576.5An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies,CVE-2026-130586.5An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction comm CVE-2026-130598.1An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level a CVE-2026-13069.8The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'e CVE-2026-130606.5An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to CVE-2026-130614.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stag CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep