VendorsEdge, Security
WatchGuard
WatchGuard makes Firebox firewalls and the Fireware OS, AuthPoint multi-factor authentication, endpoint security and Wi-Fi access points.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 18 Dec 2025
- Incidents on record
- 2
Response to exploited bugs
Not rated. 1 reviewed zero-day on record. A grade needs at least 3.
Fixing privately reported bugs
75 range 65–85rank 7 of 20
Provisional 5 private reports, published on 3 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. 1 reviewed zero-day in the last 36 months. A grade needs at least 3.
- First fix within a day, for its one reviewed zero-day.
- Every supported version fixed within a day, for its one reviewed zero-day.
- First advisory within a day, for its one reviewed zero-day.
- Fixing privately reported bugs: B- (75), provisional. Median 119 days from private report to fix (5 cases, 3 with a vendor fix date). 2 of 5 took longer than ZDI's 120-day deadline. All concern FireWare OS.
- 1 of 2 reviewed exploited bugs had a public fix before exploitation was reported. It does not count toward the response grade.
Response to exploited bugs: sub-scores
- Time to first advisory1 zero-day, within a day781 case, low confidence, not used for this vendor
- Time to first fix1 zero-day, within a day781 case, low confidence, not used for this vendor
- Time to fix all versions1 zero-day, within a day781 case, low confidence, not used for this vendor
- OpennessAdvisories available by RSS. 1 of 1 advisories said the bug was exploited. 1 of 1 fixed zero-day with a public fix date for every version.675 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 119 days from private report to fix (5 cases, 3 with a vendor fix date)75B−5 cases, low confidence, weight 100%
Response fingerprint
Median of 1 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.
Counts toward the response grade 1
- 18 Dec 2025WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE), exploited at disclosure
Not graded 1: n-days, unreviewed timelines and end-of-life products
- 17 Sep 2025WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
2 in 24 months, 1 with known ransomware use, 50% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 18 Dec 2025 | WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE), exploited at disclosureCVE-2025-14733 | 9.3 | same day | same day | same day | Fixed | Counts toward grade |
| 17 Sep 2025 | WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE)CVE-2025-9242 | 9.3 | 0h | same day | same day | Fixed | Not graded: n-day |
Private reports
Median 119 days, 40% over 120 days, 0 published unpatched
Bugs reported privately to WatchGuard by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 30 Sep 2026 | ZDI-26-750CVE-2026-18145 | FireWare OS | 119to vendor fix, 29 Sep 2026 | Yes |
| 30 Sep 2026 | ZDI-26-499, ZDI-26-500, ZDI-26-501, ZDI-26-749CVE-2026-13046, CVE-2026-13050, CVE-2026-13053, CVE-2026-13054 | FireWare OS | 130to vendor fix, 29 Sep 2026 | Yes |
| 9 Sep 2026 | ZDI-26-632CVE-2026-13086 | FireWare OS | 133to vendor fix, 27 Aug 2026 | Yes |
| 15 Jul 2026 | ZDI-26-428CVE-2026-8247 | FireWare OS | 91to publication | Yes |
| 15 Jul 2026 | ZDI-26-427CVE-2026-13084 | FireWare OS | 112to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get WatchGuard's own alerts
- EmailWatchGuard PSIRT email notificationsSign up for the vendor’s security notification emails.
- RSSWatchGuard PSIRT advisories and CVEs RSSAdd the advisory feed to a feed reader or chat integration.
- XWatchGuard on XFollow the account and turn on notifications.
- Advisory pageWatchGuard PSIRT portalCheck the advisory page. It has no push channel.
What we watch
- RSSWatchGuard PSIRT advisories and CVEs RSS
See sources and health for when each was last read.
Grade not rated.