CISA says ransomware gangs are now using a critical WatchGuard firewall bug to break into vulnerable networks. The flaw, CVE-2025-14733, is an unauthenticated remote-code-execution issue caused by an out-of-bounds write in WatchGuard Firebox devices running Fireware OS 11.x, 12.x, and 2025.1 through 2025.1.3; WatchGuard said exposure depends on IKEv2 VPN and some branch office VPN configurations, and CISA had already listed it as actively exploited in December.
Why it matters: Organizations using affected WatchGuard Firebox firewalls face elevated risk because this bug is now tied not just to intrusion activity but to ransomware. Patch immediately, check WatchGuard's indicators of compromise, and review IKEv2 and branch office VPN configurations on exposed devices.
Sergiu Gatlan
2026.09.10
100% relevant
This article establishes a distinct tracked development: CISA newly confirmed that the already exploited WatchGuard Firebox flaw CVE-2025-14733 is specifically being used in ransomware attacks, escalating the severity and urgency of the event.
← Back to all stories