CVE-2026-93434
CVE-2026-93434 · Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
fireware os
- Versions
- ≥ 12.0, < 12.5.22: Affected (custom)
Update to 12.5.22
fireware os
- Versions
- ≥ 2025.1, < 2026.4: Affected (custom)
- ≥ 12.0, < 12.12.4: Affected (custom)
Update to 12.12.4; Update to 2026.4