CVE-2026-13728

EUVD-2026-41458
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources.

This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.4 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.5%
Affected Products (NVD)
VendorProductVersion
watchguardfireware
12.1 ≤
𝑥
< 12.12.1
watchguardfireware
2025.1 ≤
𝑥
< 2026.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://psirt.watchguard.com/CVE-2026-13728
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00025