CVE-2026-3344: WatchGuard Firebox System Integrity Check Bypass
A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 2026.1.2 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.11.8 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.5.17 - Compensating control
WatchGuard Firebox System Integrity Check Bypass: mitigate by preventing untrusted parties from submitting/serving maliciously-crafted firmware update packages to devices performing Fireware OS firmware updates.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3344?
CVE-2026-3344 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-3344?
To fix CVE-2026-3344, ensure that you upgrade WatchGuard Fireware OS to a version later than 12.11.7, 12.5.16, or 2026.1.1.
What systems are affected by CVE-2026-3344?
CVE-2026-3344 affects WatchGuard Fireware OS versions from 12.0 up to 12.11.7, as well as specific versions within the 12.5 and 2025.x series.
What type of attack does CVE-2026-3344 enable?
CVE-2026-3344 allows an attacker to bypass the filesystem integrity check and maintain limited persistence through a malicious firmware update.
Who reported CVE-2026-3344?
CVE-2026-3344 was reported by WatchGuard's internal security team through their PSIRT process.