CISA has confirmed that ransomware operators are exploiting CVE-2025-14733, a critical remote code execution vulnerability affecting WatchGuard Firebox appliances. The flaw was originally disclosed and patched in December 2025 and had already been added to CISA’s Known Exploited Vulnerabilities Catalog after WatchGuard observed active exploitation. The September 10, 2026 update is significant because CISA has now specifically marked the vulnerability as being used in ransomware attacks. This means organizations still running vulnerable Fireware versions are not dealing with an abstract possibility or even just opportunistic scanning. The vulnerability is now part of the toolset being used by financially motivated attackers to gain access to victim networks. 

CVE-2025-14733 is an out-of-bounds write vulnerability in the `iked` process of WatchGuard Fireware OS. It carries a CVSS v4 score of 9.3 and can allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable Firebox. The vulnerability affects Mobile User VPN with IKEv2 and Branch Office VPN configurations using IKEv2 with a dynamic gateway peer. WatchGuard also warns that devices may remain vulnerable in certain circumstances even after the originally vulnerable configuration has been removed, particularly where a Branch Office VPN to a static gateway peer remains configured. That detail matters because administrators cannot safely determine exposure simply by checking whether a current configuration visibly uses the affected feature.

The affected software range is broad. Vulnerable installations include Fireware OS 2025.1 through 2025.1.3, 12.0 through versions before 12.11.6, T15 and T35 releases before 12.5.15, and affected FIPS builds before the corrected 12.3.1 release. WatchGuard released fixes in Fireware OS 2025.1.4, 12.11.6, 12.5.15 and the corresponding updated FIPS build. Older 11.x systems are also affected, with some releases already outside normal support.

The most important security issue, however, is not simply the remote code execution. It is where that code executes.

A Firebox is normally deployed at or near the edge of the enterprise network. It terminates VPN connections, enforces network policy, knows internal address space and may contain credentials or pre-shared secrets associated with site-to-site connectivity. Compromise of such a device gives an attacker something much more valuable than control of another random server. It gives them a trusted position directly inside the organization’s security architecture.

This is precisely why ransomware operators increasingly target VPN gateways, firewalls and other edge infrastructure. Traditional phishing requires the attacker to convince a user to open a file or disclose credentials. An unauthenticated RCE in an exposed firewall can potentially remove the user from the equation entirely. The attacker sends specially crafted network traffic to the device, compromises it and then begins working inward from an infrastructure component defenders already trust.

WatchGuard’s own post-exploitation findings demonstrate the intelligence value of that access. The company has observed attackers exploiting vulnerable Fireboxes and exfiltrating the device’s active configuration. In one variant, the attackers encrypted and copied the active configuration file to their infrastructure. In another, they created a gzip archive containing both the active configuration and the local management-user database and exfiltrated the archive.

That behavior should attract as much attention as the code execution itself.

A firewall configuration is effectively a network map created by the defenders.

It contains interfaces, internal networks, routes, policies, VPN relationships, address objects and other information showing how the organization is structured. Instead of spending days scanning an unfamiliar network, an attacker who steals the firewall configuration may receive a reasonably detailed guide showing where important systems live and which paths are permitted between them.

The local management-user database creates an additional credential risk. If account information or password material can be retrieved from the compromised appliance, attackers may be able to reuse those credentials elsewhere or attempt offline cracking. WatchGuard therefore advises organizations where successful exploitation is suspected to rotate all secrets stored on the Firebox.

That recommendation is critical because patching alone does not invalidate information already stolen.

If the attacker has copied a VPN pre-shared key, administrator credential or other long-lived secret, installing the fixed firmware does nothing to make that secret unknown again. The Firebox may no longer be exploitable through CVE-2025-14733, but the attacker may retain another legitimate route into the environment.

The ransomware confirmation strengthens the need for this compromise-assessment approach. Ransomware crews rarely exploit an edge appliance simply because they enjoy owning firewalls. The device is useful because it provides access to the systems behind it.

The likely attack progression is therefore more important than the vulnerable appliance itself.

Initial access through the Firebox can be followed by credential theft, internal reconnaissance, lateral movement, privilege escalation, backup targeting and eventually ransomware deployment or data exfiltration. The firewall vulnerability becomes the first stage in a much larger intrusion.

This is why organizations that discover they were vulnerable during the active exploitation period should not simply update the firmware and close the ticket. They need to establish whether the device was actually exploited and whether attackers moved beyond it.

WatchGuard has published several indicators that can assist with that process. Known attacker infrastructure includes IP addresses associated with exploit attempts and post-compromise activity. The `iked` service may also generate an `Invalid peer certificate chain` message when it receives an IKEv2 authentication payload containing more than eight certificates, a pattern WatchGuard says has appeared in observed malicious activity. Crashes of the `iked` process can provide another, weaker signal because legitimate conditions may also cause process failures.

Administrators should therefore review Firebox logs from the period before patching, not only current activity. External network telemetry should also be examined for connections between the Firebox and known or unfamiliar external infrastructure, particularly outbound communications following suspicious IKEv2 activity.

The outbound direction is especially important.

Security teams tend naturally to concentrate on malicious traffic entering the firewall. But once the firewall itself is compromised, outbound connections originating from the appliance may provide stronger evidence of post-exploitation activity. A security gateway establishing unexpected sessions to unfamiliar internet addresses should be treated very differently from an ordinary endpoint doing the same thing.

External log retention becomes equally important because successful remote code execution means the integrity of local evidence can no longer be assumed. If attackers gain sufficient control over the appliance, they may be able to alter or delete logs. Firewalls should therefore send security, authentication and administrative events to independent SIEM or syslog infrastructure where evidence survives even if the appliance is later compromised.

Organizations should also compare the running configuration against a known-good baseline. Unexpected firewall rules, NAT entries, VPN tunnels, administrator accounts or management settings may indicate persistence or deliberate weakening of security policy. Attackers do not necessarily need to leave conventional malware behind if a simple configuration change provides continued access.

The number of devices that remained exposed months after remediation became available is perhaps the most frustrating part of the story. Shadowserver identified more than 115,000 unpatched WatchGuard Firebox appliances exposed online in December 2025. By September 2026, nearly 9,000 remained vulnerable, despite the patches having been available for roughly nine months.

That decline shows substantial remediation progress, but 9,000 internet-exposed critical security appliances running software known to be actively exploited remains a sizeable attack surface.

It also illustrates a recurring problem with network appliances: they frequently patch more slowly than endpoints.

Windows laptops can often receive updates automatically overnight. Firewalls, VPN gateways and other edge devices tend to involve maintenance windows, HA considerations, configuration backups, compatibility testing and operational concern about disrupting connectivity. Those are legitimate constraints, but attackers benefit from every additional week the upgrade is postponed.

Ransomware operators are particularly pragmatic about this. They do not need a new zero-day if thousands of organizations still expose a reliable vulnerability that was fixed months ago. An old exploit with a stable success rate is often more useful than a sophisticated new vulnerability requiring additional development.

The similarity between CVE-2025-14733 and the earlier CVE-2025-9242 also deserves attention. WatchGuard patched CVE-2025-9242 in September 2025 after identifying another critical Firebox RCE associated with IKEv2. CISA later marked that vulnerability as actively exploited as well.

The recurrence should encourage vendors and defenders to examine the IKE processing path as a broader security boundary rather than treating each CVE as an unrelated event.

IKE services sit on the untrusted edge by design.

They have to parse complex negotiation traffic before a VPN session is established.

That makes memory safety in the IKE daemon especially important because an attacker does not need a valid VPN credential if they can compromise the service while it is processing the negotiation itself.

The configuration nuance in CVE-2025-14733 also provides a broader lesson about attack-surface reduction. Administrators often assume that disabling a vulnerable feature removes the risk. But if supporting state, certificates, objects or related configuration remains active elsewhere, vulnerable code paths may still be reachable. Security validation needs to test actual network behavior rather than relying entirely on the management interface’s apparent configuration state.

For environments that cannot immediately upgrade, WatchGuard provides a limited temporary mitigation for Fireboxes configured only with Branch Office VPN tunnels to static gateway peers. Administrators can restrict IKEv2 access according to WatchGuard’s secure-access recommendations. However, the vendor is clear that upgrading to a fixed Fireware release is the primary solution.

Network-level restrictions should therefore be treated as exposure reduction, not remediation.

Where static site-to-site peers are used, IKE traffic should ideally be accepted only from known peer IP addresses. There is little reason for an appliance expecting connections from three branch-office gateways to process IKE packets arriving from the entire internet.

Remote-user VPN environments are more difficult because legitimate users may originate from unpredictable networks. In those cases, patching becomes even more important.

Organizations should also maintain an accurate inventory of edge appliances and firmware versions. Firewalls sometimes remain deployed for many years and can become effectively invisible to centralized vulnerability-management systems because traditional endpoint agents cannot run on them. Security teams therefore need dedicated asset discovery capable of identifying device type, model, software version and external exposure.

The fact that ransomware groups are now exploiting CVE-2025-14733 also reinforces why CISA’s ransomware-use flag deserves strong prioritization.

KEV already tells defenders that exploitation is occurring. The ransomware designation provides additional context about the attack outcome. It means the vulnerability has moved beyond initial experimentation or espionage use and is participating in financially motivated intrusion chains that can result in operational disruption, data theft and encryption. 

For enterprises, that should trigger both vulnerability-management and incident-response workflows. Patch immediately if vulnerable. But if the appliance remained exposed during the exploitation period, also hunt. Review the firewall. Review authentication. Review VPN secrets. Review the internal systems reachable from the firewall. 

And review whether activity associated with the device preceded suspicious Windows or Active Directory behavior elsewhere in the environment. The reason is simple. Once attackers compromise the firewall, the incident is no longer a firewall incident. It becomes a network incident. 

The broader lesson from CVE-2025-14733 is that perimeter security products have become some of the most valuable initial-access targets in the ransomware ecosystem.

They are exposed because they have to be. They are trusted because they are security devices. They often lack conventional EDR visibility. And they possess exactly the network information attackers want after gaining access. That combination makes them unusually attractive. A firewall can stop an enormous number of attacks aimed at the systems behind it. But when the firewall itself contains an unauthenticated RCE, the attacker no longer needs to get through the firewall. They simply take control of the gate.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December. [...]

Source: CISA: WatchGuard RCE flaw now exploited in ransomware attacks via Bleeping Computer — published 10 Sep 2026.