CVE-2026-13728
Last modified
CVE-2026-13728 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Metrics
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Watchguard | Fireware | >= 12.1, < 12.12.1 |
| Watchguard | Fireware | >= 2025.1, < 2026.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-13728?
How severe is CVE-2026-13728?
How do I fix CVE-2026-13728?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1372The Tutor LMS Elementor Addons plugin for WordPress is vulne…4.3
- CVE-2026-13722WatchGuard Fireware OS contains a firmware validation bypass…7.2
- CVE-2026-13723A vulnerability in the `zipx.Unzip` extraction routine of De…6.5
- CVE-2026-13724Client-Side Enforcement of Server-Side Security vulnerabilit…4.3
- CVE-2026-13725The Dynamic Pricing With Discount Rules for WooCommerce Word…7.1
- CVE-2026-13726The MPG WordPress plugin before 4.1.8 does not sanitise and…7.1
- CVE-2026-13729The Podlove Podcast Publisher WordPress plugin before 4.5.3 …4.3
- CVE-2026-1373The Easy Author Image plugin for WordPress is vulnerable to …6.4
- CVE-2026-13731The WPBot – AI ChatBot for Live Support, Lead Generation, AI…7.2
- CVE-2026-13733The Download Manager plugin for WordPress is vulnerable to S…6.4
- CVE-2026-13736The NewPath WildApricotPress Add-on WordPress plugin throug…5.3
- CVE-2026-13737CommServe contained an allowlist bypass vulnerability affect…9.2
Are you affected by CVE-2026-13728?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST