CVE-2026-3343CWE-79cross-site-scripting

CVE-2026-3343

Medium · published March 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-03T19:15Z
Affected products (2)
ProductVersionsFixed in
watchguard/fireware≥ 12.7, < 12.11.812.11.8
watchguard/fireware≥ 2025.1, < 2026.1.22026.1.2
References (2)
https://psirt.watchguard.com/CVE-2026-3343 · 5d1c2695-1a31-4499-88ae-e847036fd7e3https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00004 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 03 MAR 13:17Z
    WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI
    cvelistv5