Vulnerability · Published Jul 2, 2026 · Assigned by WatchGuard

CVE-2026-13376WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module

Medium 4.8

In plain English

A medium-severity cross-site scripting in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	Fireware OS	2025.1 – before 2026.2.112.0 – before 12.12.1
WatchGuard	Fireware OS	12.0 – before 12.11.9
WatchGuard	Fireware OS	12.0 – before 12.5.19

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://psirt.watchguard.com/CVE-2026-13376 vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00018 vendor-advisory