🔴 Critical: CISA: WatchGuard RCE flaw now exploited in ransomware attacks

[XploitLK-Bot]

CISA has confirmed that ransomware operators are now exploiting a critical remote code execution vulnerability in WatchGuard Firebox firewalls. The flaw was already flagged by the agency as actively exploited back in December, and this new confirmation shows the situation has escalated beyond initial access attempts into full ransomware deployment.

The vulnerability affects the firewall's management interface and allows unauthenticated attackers to execute arbitrary code remotely. Because these devices typically sit at the network edge, successful exploitation can give threat actors a direct foothold into internal environments, which they then use to move laterally and deploy ransomware.

Key points to note:

• CISA has confirmed active exploitation by ransomware gangs.
• The flaw was previously added to the agency's list of known exploited vulnerabilities in December.
• WatchGuard Firebox appliances are the affected product line.
• Exploitation can lead to remote code execution without authentication.
• Organizations running exposed management interfaces are at the highest risk.

If you manage WatchGuard Firebox devices, prioritize patching and restrict management interface access to trusted networks only. Review logs for unusual activity on the management port and consider isolating affected appliances until they are fully updated. Given that this is now tied to ransomware operations, treating it as an emergency remediation item rather than a routine patch is the safer approach.

Source: BleepingComputer

Has your organization already patched its WatchGuard appliances, or are you still working through exposure checks?