Company
Seattle-based network security vendor selling Firebox firewall appliances and related managed services, distributed largely through resellers and managed service providers to small and mid-sized businesses.
Huntress traced an MSP administrator's October 7 Bing search to watchguard-vpn[.]net, a WatchGuard lookalike that served a genuine signed installer. The domain was offline by October 13, and earlier WatchGuard and Microsoft reports had described fake clients.
Reality
WatchGuard patched CVE-2026-86131, a 9.2-rated Fireware OS bug letting whoever controls a BOVPN over TLS server run root commands on connecting Fireboxes. The Firebox at risk is the tunnel client, and its safety depends on who controls the server it dials.
Reality
CISA now flags CVE-2025-14733 as used in ransomware attacks, nine months after WatchGuard shipped the fix. Shadowserver's scans show the exposed population fell from more than 115,000 to nearly 9,000, and that remainder is the target set.
Reality
BOD 26-04 revoked the federal CVSS requirement on June 10. The two decision fields CISA promised, automatability and technical impact, go out through Vulnrichment; the KEV feed does not carry them, so every defender does the join.
Reality
Sophos found the timezone_check implant on compromised Cisco Firewall Management Center devices in August 2026 and assessed it likely Sandworm's work. Generic SysV persistence replaces the firmware trick and widens the appliances it can run on.
Reality