CVE-2026-13374CWE-79cross-site-scripting

CVE-2026-13374

Medium · published July 3, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-03T04:16Z
Affected products (3)
ProductVersionsFixed in
watchguard/fireware≥ 12.4, < 12.12.112.12.1
watchguard/fireware≥ 2025.1, < 2026.2.12026.2.1
watchguard/fireware≥ 12.5, ≤ 12.5.18—
References (2)
https://psirt.watchguard.com/CVE-2026-13374 · 5d1c2695-1a31-4499-88ae-e847036fd7e3https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00016 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 02 JUL 23:05Z
    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration
    cvelistv5