CVE-2026-1498

UNKNOWN 0.0

WatchGuard Firebox LDAP Injection

CVSS Score

0.0

EPSS Score

0.7%

EPSS Percentile

49th

An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.

CWE	CWE-90
Vendor	watchguard
Product	fireware os
Published	Jan 30, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for watchguard fireware os

Be the first to know when new unknown vulnerabilities affecting watchguard fireware os are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

WatchGuard / Fireware OS

2025.1 < 2026.1 12.0 < 12.11.7

WatchGuard / Fireware OS

12.0 < 12.5.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

psirt.watchguard.com: https://psirt.watchguard.com/CVE-2026-1498 watchguard.com: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00001

Credits

Discovered internally by WatchGuard