{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3987", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-03-11T15:01:46.222Z", "datePublished": "2026-04-01T21:32:30.426Z", "dateUpdated": "2026-08-10T16:46:12.527Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-10T16:46:12.527Z"}, "title": "WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI", "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process."}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.1", "versionType": "custom", "lessThan": "2026.2"}, {"status": "affected", "version": "12.6.1", "versionType": "custom", "lessThan": "12.12"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-3987", "tags": ["vendor-advisory"]}, {"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00009", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1", "versionEndExcluding": "2026.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.6.1", "versionEndExcluding": "12.12"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22", "type": "CWE", "cweId": "CWE-22"}]}], "credits": [{"lang": "en", "value": "btaol", "type": "finder"}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2, Fireware OS 12.12"}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this issue in the wild."}], "datePublic": "2026-04-01T21:32:30.426Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-3987"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T03:55:30.681Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T13:29:16.346048Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:29:22.158Z"}}], "cna": {"title": "WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI", "credits": [{"lang": "en", "type": "finder", "value": "btaol"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.1", "lessThan": "2026.2", "versionType": "custom"}, {"status": "affected", "version": "12.6.1", "lessThan": "12.12", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this issue in the wild."}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2, Fireware OS 12.12"}], "datePublic": "2026-04-01T21:32:30.426Z", "references": [{"url": "https://psirt.watchguard.com/CVE-2026-3987", "tags": ["vendor-advisory"]}, {"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00009", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.2", "versionStartIncluding": "2025.1"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.12", "versionStartIncluding": "12.6.1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-10T16:46:12.527Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3987", "state": "PUBLISHED", "dateUpdated": "2026-08-10T16:46:12.527Z", "dateReserved": "2026-03-11T15:01:46.222Z", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "datePublished": "2026-04-01T21:32:30.426Z", "assignerShortName": "WatchGuard"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThanOrEqual": "12.11.8", "status": "affected", "version": "12.6.1", "versionType": "semver"}, {"lessThanOrEqual": "2026.1.2", "status": "affected", "version": "2025.1", "versionType": "semver"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.This issue affects Fireware OS 12.6.1 up to and including 12.11.8 and 2025.1 up to and including 2026.1.2."}], "id": "CVE-2026-3987", "lastModified": "2026-06-17T10:44:34.500", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3987", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-01T22:16:21.350", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00009"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.6.1,12.11.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2025.1,2026.1.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Fireware OS", "source": "cna", "vendor": "WatchGuard"}, "product": "fireware_os", "vendor": "watchguard"}], "analysis": {"en": {"generated_at": "2026-04-02T05:07:29.257033+00:00", "value": {"mitigation_remediation": ["Apply the latest Fireware OS firmware update that includes the fix (versions newer than 12.11.8 or 2026.1.2).", "Verify the firmware update by checking the system\u2019s version information.", "Restrict access to the Web UI to trusted internal networks and enforce strong authentication."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WatchGuard Fireware OS installations on Firebox devices, including all releases from version 12.6.1 through 12.11.8 and from 2025.1 through 2026.1.2.", "description_and_impact": "A path traversal flaw in the Fireware OS Web UI can be leveraged by an authenticated user with privileged permissions to overwrite arbitrary files on the device. This vulnerability enables the execution of code within the context of an elevated system process, providing the attacker with full control of the firewall. The CVE description explicitly states the potential for arbitrary code execution, while the broader impacts on confidentiality, integrity, and availability are inferred based on the nature of the code execution flaw.", "risk_and_exploitability": "The CVSS base score of 8.6 indicates a high severity vulnerability. Exploit probability data from EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires remote access to the Web UI and valid credentials with elevated privileges; thus, the attack vector is remote authenticated. Once an attacker authenticates, they can exploit the path traversal to place malicious files that the system process will execute."}}}}, "created": "2026-04-02T07:47:09.961613+00:00", "updated": "2026-04-02T20:16:08.057655+00:00", "vendors": ["watchguard", "watchguard$PRODUCT$fireware_os"]}