CISA: WatchGuard Firebox RCE Flaw Now Exploited in Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a critical remote code execution (RCE) vulnerability in WatchGuard Firebox firewalls. The flaw, which was initially flagged by CISA as actively exploited in December, has now been observed in ransomware attacks, raising the urgency for organizations to patch and mitigate.

CISA's confirmation underscores the severity of the vulnerability, which could allow attackers to gain full control of affected firewall devices. Successful exploitation could lead to network compromise, lateral movement, data exfiltration, and deployment of ransomware.

WatchGuard has released security advisories and firmware updates to address the vulnerability. CISA has also issued a Binding Operational Directive (BOD) requiring federal agencies to patch affected systems promptly. Organizations are advised to apply the latest firmware updates, disable unused services, and monitor for indicators of compromise.

The specific ransomware group(s) involved have not been publicly identified, and detailed exploit mechanics have not been fully disclosed. However, the confirmed active exploitation in ransomware campaigns elevates the risk for all WatchGuard Firebox users.

Organizations should prioritize patching, review their security configurations, and ensure that firewall management interfaces are not exposed to the internet unless necessary. Regular backups and incident response readiness are also recommended to mitigate the impact of potential ransomware attacks.