CVE-2026-93434: Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed if the WatchGuard Fireware OS management SSH interface is reachable by a remote attacker. The issue is in the SSH authentication process.
Does exploitation require valid SSH credentials or prior access?
No. The vulnerability is described as exploitable by a remote, unauthenticated attacker that can access the management SSH interface.
What could an attacker obtain through successful exploitation?
A successful attacker can extract sensitive configuration data. The extraction is described as blind, so the attacker may infer secrets through crafted requests rather than receiving them directly in a normal response.