Read the original at NVD — National Vulnerability Database →

nvd.nist.gov • August 12, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

View Analysis Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Stored XSS Vulnerability in WatchGuard Fireware OS (CVE-2026-13374) A Cross-site Scripting (XSS) vulnerability, identified as CVE-2026-13374, has been discovered in WatchGuard Fireware OS, specifically within the ConnectWise Technology Integration module. This vulnerability allows for Stored XSS attacks, which can lead to unauthorized access and data manipulation. It is an additional attack vector related to CVE-2025-13937. The affected versions include Fireware OS 12.4 through 12.12, 12.5 up to 12.5.18, and 2025.1 through 2026.2. The vulnerability was published on July 2, 2026, and is currently unmitigated, posing a significant risk to users of the affected software. Security professionals are advised to monitor the situation closely and apply any forthcoming patches. 2 sources 52

Extracted Entities

Read the original at NVD — National Vulnerability Database →

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)