Watch Guard Warns of Active Exploitation of Critical Fireware OS VPN Vulnerability
Summary: WatchGuard released fixes for CVE-2025-14733, a CVSS 9.3 out-of-bounds write in the Fireware OS iked process that lets a remote unauthenticated attacker execute arbitrary code, affecting mobile user VPN and branch office VPN using IKEv2 with a dynamic gateway peer. WatchGuard said it has observed active exploitation attempts, and CISA added the flaw to its KEV catalog on December 19, 2025, with a December 26, 2025 deadline for FCEB agencies.
Bottom line: Shadowserver Foundation data shows 117,490 internet-exposed WatchGuard instances vulnerable to this flaw, more than 35,600 of them in the U.S., and one attacking IP was also linked by Arctic Wolf to exploitation of Fortinet vulnerabilities - WatchGuard describes this as part of a wider campaign against edge networking equipment from multiple vendors.