CISA: WatchGuard Firebox RCE exploited in ransomware attacks

Thu, 10 Sep 2026 14:58:06 +0000

Engineer — Act: CISA KEV-listed RCE in WatchGuard Firebox is now confirmed ransomware-leveraged; patch Firebox to the latest available version immediately and audit edge-device logs for signs of pre-patch compromise.
SOC/IR — Act: Ransomware actors exploiting an RCE in a perimeter firewall is an assume-breach scenario — sweep for lateral movement originating from WatchGuard appliances and hunt for IOCs tied to this campaign since CISA’s December KEV addition.
Leader — Act: Ransomware exploitation of a perimeter firewall is board-level risk; confirm this week whether WatchGuard Firebox is in your estate, verify emergency patching is underway, and brief leadership before an incident forces the conversation.

Watchguard on CuraSec