WatchGuard RCE Vulnerability Exploited in Ransomware Attacks

CISA has updated its Known Exploited Vulnerabilities (KEV) catalog to reflect that ransomware gangs are now actively exploiting CVE-2025-14733, a critical remote code execution (RCE) flaw in WatchGuard Firebox firewalls. The vulnerability stems from an out-of-bounds write condition that allows unauthenticated threat actors to execute malicious code remotely with low complexity. Initially flagged in December 2025, the flaw remains a significant threat as thousands of devices remain unpatched worldwide.

The attack chain primarily targets firewalls configured with IKEv2 VPNs. However, WatchGuard warns that devices may remain vulnerable even after deleting these configurations if a branch office VPN to a static gateway peer is still active. The scale of the threat is substantial, with Shadowserver reporting that approximately 9,000 instances remain exposed nearly nine months after the initial disclosure.

This exploitation represents a high risk to small and mid-sized enterprises (SMEs), which form the bulk of WatchGuard's 250,000 customers. Given the involvement of ransomware operators, immediate patching is required to prevent data exfiltration and encryption. Organizations should also be aware of related vulnerabilities, such as CVE-2025-9242 and CVE-2022-23176, which have historically targeted the same hardware.