CISA Confirms Ransomware Exploitation of WatchGuard Firebox RCE Flaw

CISA has confirmed that ransomware actors are exploiting CVE-2025-14733, a critical remote-code-execution vulnerability in WatchGuard Firebox appliances running multiple Fireware OS versions. The update underscores how firewall and VPN flaws can remain durable entry points months after disclosure.¹

The agency’s Known Exploited Vulnerabilities catalog now lists the WatchGuard Firebox flaw as having “Known” ransomware campaign use. CISA says internet-accessible instances should be checked for signs of compromise after mitigations are applied.¹

The September 10, 2026, update changes the defender calculus. Affected organizations should treat exposed Firebox systems as possible footholds, not merely as devices awaiting routine maintenance.

CVE-2025-14733 affects the Fireware OS iked process and may allow a remote, unauthenticated attacker to execute arbitrary code. CISA says exposure applies to Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.¹ BleepingComputer reported that affected Fireware OS versions include 11.x and later, 12.x and later, and 2025.1 through 2025.1.3.²

Exposure depends on VPN configuration

The primary risk is not every Firebox deployment equally, but Firebox appliances with IKEv2-related VPN exposure. WatchGuard previously said unpatched devices were vulnerable when configured to use IKEv2 VPN. BleepingComputer also reported a residual-risk condition: systems may remain exposed even after vulnerable settings are removed if a branch office VPN to a static gateway peer is still configured.²

That detail matters for security operations teams because configuration history can complicate asset triage. A firewall that no longer appears to have the original vulnerable configuration may still warrant review if BOVPN settings, static gateway peers or internet-facing IKEv2 services remain present.

Threat-intelligence summaries published after CISA’s update also emphasized IKEv2 and BOVPN mitigation, monitoring and SOC triage as immediate priorities.⁵

Shadowserver data cited by BleepingComputer showed that more than 115,000 unpatched Firebox firewalls were exposed online in December, while nearly 9,000 remained unsecured after nine months.² Shield53 likewise framed the issue as a continuing risk for small and midsize businesses and managed service providers, warning that perimeter-firewall compromise can give ransomware crews a path around endpoint-focused controls.³

Why ransomware crews keep targeting edge devices

Firewalls and VPN appliances sit at the boundary between the internet and internal networks. When attackers compromise them, they may gain a foothold before traffic reaches systems monitored by conventional endpoint tooling. They may also obtain access to VPN paths, routing context, credentials, logs or administrative interfaces that help them move laterally.

The WatchGuard case fits a broader ransomware pattern. Attackers continue to revisit edge-device vulnerabilities long after vendors publish fixes, relying on patch lag, incomplete asset inventories and complex appliance configurations.

HackWire’s contextual report described compromised firewalls as high-value ransomware footholds and urged defenders to audit management exposure and managed-service patch posture.⁶ The Axe Report’s September 10 roundup placed the WatchGuard issue among other edge and infrastructure risks, reinforcing the operational problem of exploitable device populations persisting after disclosure.⁸

For MSPs, the exposure is especially consequential. BleepingComputer noted that WatchGuard serves more than 250,000 small and midsize companies through more than 17,000 security resellers and service providers worldwide.² A vulnerable perimeter appliance in that ecosystem can represent not only one organization’s remote-access risk, but also a potential operational blind spot across many customer environments.

Patching is necessary, but not sufficient

CISA’s required action is to apply vendor mitigations, follow applicable federal guidance or discontinue use if mitigations are unavailable.¹ For private-sector defenders, the practical equivalent is to identify all Firebox appliances, confirm Fireware versions, determine whether IKEv2 or BOVPN configurations are present, and validate that fixes or mitigations are applied.

But because CISA now links the flaw to ransomware activity, response should include a compromise assessment. CISA’s note specifically calls for checking internet-accessible instances for signs of potential compromise after mitigation.¹ WatchGuard has also shared indicators of compromise to help customers determine whether Firebox devices were hacked, according to BleepingComputer.²

Security teams should preserve relevant evidence before making disruptive changes where feasible. That includes configuration exports, logs, VPN settings, admin-account state and network-flow data. Cyber Decision Ledger’s response record recommends containment, evidence preservation, validated patching, credential rotation and clean rebuild or replacement when Firebox compromise cannot be excluded.⁴

Operational steps for SOC teams

Organizations running WatchGuard Firebox appliances should prioritize the following actions:

Inventory all Firebox devices, including appliances managed by MSPs or regional IT teams, and confirm Fireware OS versions against the affected ranges reported for CVE-2025-14733.²
Identify internet-facing IKEv2 exposure, Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 with dynamic gateway peers, while also reviewing residual BOVPN static peer scenarios.¹²
Apply WatchGuard mitigations or supported software updates, and retire or isolate devices that cannot be brought into a safe state.¹
Run compromise checks using vendor indicators, firewall logs, VPN authentication records, administrative account changes and unusual outbound connections.²
Rotate credentials and shared secrets associated with VPN, administrative access and downstream systems if exposure or compromise cannot be ruled out.³⁴
Restrict management interfaces and remote-access services to trusted administrative networks wherever possible, and verify that MSP-managed appliances follow the same patch and access-control posture.³⁶

The key distinction is sequencing. Teams should not wait for a full investigation before applying urgent mitigations. But they also should not assume that applying an update erases attacker access. If a perimeter firewall was reachable while vulnerable, defenders should validate both the fix and the integrity of the device and associated credentials.

A continuing edge-device risk

CVE-2025-14733 was added to CISA’s KEV catalog on December 19, 2025, with a federal remediation due date of December 26, 2025.¹ The September 10, 2026, ransomware-use update shows that exploitation risk did not end with the original deadline.

For security operations teams, the lesson is direct: firewall and VPN vulnerabilities need post-patch validation, configuration-specific exposure analysis and incident-response checks.

In the WatchGuard case, the most important question is no longer only whether a Firebox has been patched. It is whether the appliance was exposed long enough to become part of a ransomware intrusion path.