PatchTheCVECVE-2026-13728: In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to enc
CVE-2026-13728 is a medium-severity flaw (CVSS 4.4) affecting fireware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2026-07-03 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-13728?
fireware: upgrade to 12.12.1, 2026.2.1. Exact commands for each OS are on this page.
Is CVE-2026-13728 being exploited?
CVE-2026-13728 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-13728 affect?
CVE-2026-13728 affects fireware. Severity is medium (CVSS 4.4). In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Por
How urgent is CVE-2026-13728?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-13368 HIGH 8.1 UPGRADE WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authenticat
- CVE-2026-13084 HIGH 7.5 UPGRADE A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker
- CVE-2026-13383 HIGH 7.2 UPGRADE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated p
- CVE-2026-13384 HIGH 7.2 UPGRADE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated pr
- CVE-2026-8247 HIGH 8.8 UPGRADE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the sa