CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA has confirmed that a critical remote code execution vulnerability in WatchGuard Firebox firewalls, previously flagged as actively exploited in December, is now being used in ransomware attacks. The agency added the flaw to its known exploited vulnerabilities catalog.
Why this matters: WatchGuard firewalls sit at the edge of corporate and government networks. They are supposed to keep attackers out. When a flaw in that hardware becomes a ransomware entry point, the blast radius is wide. Any organization running an unpatched Firebox device is handing attackers a front door. This is the kind of vulnerability that gets patched slowly because IT teams are stretched thin. CISA flagging it means the clock is already running.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.