---
id: "CVE-2022-26318"
kind: "vulnerability"
aliases: ["CVE-2022-26318"]
title: "WatchGuard Firebox and XTM Appliances: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution"
severity: "critical"
cvss: 9.8
epss: 0.78157
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "WatchGuard Firebox and XTM Appliances", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firebox", "infrastructure", "network-appliance", "watchguard", "xtm"]
not_affected_if: ["no-firebox-or-xtm-appliance"]
published_at: "2022-03-04T18:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26318", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26318", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26318", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# WatchGuard Firebox and XTM Appliances: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution

WatchGuard Firebox and XTM network appliances let an unauthenticated user execute arbitrary code on the device. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WatchGuard Firebox and XTM Appliances affected ? fixed ?

## Fix

Apply the vendor update per WatchGuard instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26318
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-26318
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26318

## From the sources

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_