Vulnerability · Published Mar 30, 2026 · Assigned by WatchGuard
CVE-2026-4315WatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UI
High 7.1
In plain English
A high-severity cross-site request forgery in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.2%top 93.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | Fireware OS | 2025.1 – before 2026.212.0 – before 12.1211.8 – through 11.12.4+541730 |
| WatchGuard | Fireware OS | 12.0 – before 12.11.9 |
| WatchGuard | Fireware OS | 12.0 – before 12.5.18 |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://psirt.watchguard.com/CVE-2026-4315 vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00006 vendor-advisory