• CVSS v3.1 base score of 7.2 (High) according to NVD analysis
• Affects WatchGuard Fireware OS versions 11.9-11.12.4_Update1, 12.0-12.11.7, and 2025.1-2026.1.1
• Authenticated privileged administrators can execute arbitrary code with root permissions via management interface
• NVD published March 3, 2026; vendor patch status pending official advisory publication

CVE-2026-3342 is an out-of-bounds write vulnerability in WatchGuard Fireware OS that can allow authenticated privileged administrators to execute arbitrary code with root permissions through an exposed management interface. NVD lists CWE-787 (Out-of-bounds Write), sourced from the CNA.

According to the NVD description, this vulnerability enables complete compromise of the affected device’s confidentiality, integrity, and availability once an attacker has privileged administrative access to the management interface. The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is network-accessible with low attack complexity but requires high privileges and no user interaction.

The vulnerability was published to NVD on March 3, 2026, with a reference to WatchGuard PSIRT advisory WGSA-2026-0003, though the vendor advisory was not yet publicly accessible at the time of NVD publication.

The vulnerability affects multiple versions of WatchGuard Fireware OS across different release branches:

• Fireware OS 11.9 up to and including 11.12.4_Update1
• Fireware OS 12.0 up to and including 12.11.7
• Fireware OS 2025.1 up to and including 2026.1.1

The vulnerability is in the management interface functionality and requires authenticated privileged administrator access for exploitation. Organizations using WatchGuard Firebox appliances as internet edge gateways, including managed service providers and small-to-medium enterprises, should prioritize addressing this vulnerability.

Because the attack vector is network-based and targets the management interface, devices with management capabilities exposed to untrusted networks face materially higher risk. The high privileges required mean that exploitation depends on an attacker first obtaining or compromising valid administrator credentials.

Contact us at Praetorian to learn how our offensive security team can help you assess your exposure to CVE-2026-3342 and other emerging threats.

• NVD — CVE-2026-3342
• WatchGuard PSIRT Advisory
• WatchGuard PSIRT Advisory
• WatchGuard PSIRT Advisory

The information presented reflects our best understanding as of the publication date based on publicly available advisories, NVD data, and vendor disclosures. Details may evolve as new information becomes available. We will update this post if material changes occur. Praetorian makes no guarantees regarding the completeness or accuracy of third-party disclosures referenced herein.