GoKawiilCISA confirms ransomware groups exploiting WatchGuard Firebox flaw CVE-2025-14733
CISA has updated its Known Exploited Vulnerabilities catalog to warn that ransomware operators are now actively abusing a critical remote-code-execution bug in WatchGuard Firebox firewalls, first flagged as exploited back in December. The flaw, an out-of-bounds write bug affecting multiple Fireware OS versions, lets unauthenticated attackers run code remotely, particularly on devices configured for IKEv2 VPN. Shadowserver data shows nearly 9,000 Firebox devices remain unpatched online nine months after fixes were released.
GoKawiil's interpretation of the reporting above, not reported fact.
The slow patch rate on a flaw known to be exploited since December shows how long dangerous vulnerabilities can linger in exposed network appliances even after fixes exist. Firewalls sit at the perimeter of enterprise networks, so a working exploit chain gives ransomware gangs a direct path into internal systems without needing stolen credentials.
- CVE-2025-14733 is an unauthenticated RCE flaw in WatchGuard Firebox firewalls now tied to ransomware attacks.
- Nearly 9,000 vulnerable Firebox devices remain exposed online despite patches being available since December.
- CISA has again ordered federal agencies to remediate under its Binding Operational Directive within a set deadline.
WatchGuard Firebox T25 Firewall Appliance — If you're running an older Firebox that's overdue for a refresh, the Firebox T25 is WatchGuard's current small-office appliance and runs the modern Fireware releases that receive active security updates. It's a straightforward way to get a supported, patchable edge device with VPN and unified threat management in one box.
See WatchGuard Firebox T25 Firewall Appliance on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “CISA: WatchGuard RCE flaw now exploited in ransomware attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.