CISA: WatchGuard RCE flaw now exploited in ransomware attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.

This flaw is tracked as CVE-2025-14733 and stems from an out-of-bounds write allowing unauthenticated threat actors to execute malicious code remotely in low-complexity attacks.

This vulnerability affects firewalls running Fireware OS 11.x and later (including 11.12.4_Update1), 12.x or later (including 12.11.5), and 2025.1 through 2025.1.3.

When it released CVE-2025-14733 security patches in December, WatchGuard said unpatched Firebox firewalls are vulnerable to attacks only if configured to use IKEv2 VPN, but noted they might still be compromised even if the vulnerable configurations have been deleted if a branch office VPN to a static gateway peer is still configured.

WatchGuard also confirmed that attackers were exploiting the flaw in the wild and shared indicators of compromise to help customers check whether their Firebox devices have been hacked.

CISA: WatchGuard RCE flaw now exploited in ransomware attacks

Other newsrooms on this story

Related reading

CISA: Windows BlueHammer flaw now exploited by ransomware gangs

CISA orders urgent action on actively exploited Langflow RCE flaw

CISA sets urgent deadline to fix Cisco flaw exploited in attacks

WatchGuard Patches Critical Vulnerabilities

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

CISA: Microsoft SharePoint flaw now exploited in ransomware attacks