Update Your Firebox — Fireware 2026.4, 12.12.4 and 12.5.22

WatchGuard has released Fireware 2026.4, Fireware 12.12.4 and Fireware 12.5.22, and all three include important security updates. We recommend that customers and partners upgrade every Firebox they own, manage or operate for clients as soon as possible.

Fireware 2026.4 is also the most feature-rich Fireware update in a long while, with WireGuard branch office VPN, Let's Encrypt certificate automation, IPv6 for Mobile VPN with IKEv2, and more.

Why you should update now

Each release resolves multiple vulnerabilities across Firebox services. Fireware 2026.4 and 12.12.4 resolve 17 CVEs, and 12.5.22 resolves 14. Affected areas include the SIP proxy, SSH authentication, the Access Portal, Active Directory authentication, the management interface, and FireCluster synchronization. Several of the fixes address pre-authentication issues.

The releases also update OpenSSH (2026.4 and 12.12.4) and OpenSSL (2026.4), and 2026.4 resolves a local credential exposure issue in the Mobile VPN with SSL client for Windows.

Full details on each CVE are in the advisories on the WatchGuard PSIRT site and in each release's notes.

What's new in Fireware 2026.4

Beyond the security fixes, 2026.4 delivers a long list of new capabilities:

• BOVPN over WireGuard: Build Firebox-to-Firebox branch office VPN tunnels with WireGuard, using public key authentication and a configurable UDP port.
• Let's Encrypt integration: Cloud-managed Fireboxes can get and automatically renew trusted SSL/TLS certificates from WatchGuard Cloud, so expired certificates stop causing outages.
• IPv6 for Mobile VPN with IKEv2: Remote users can connect over IPv6 networks.
• Custom Dynamic Aliases: Aliases can import and sync IP address and domain lists from an externally hosted feed file.
• FireCloud Network as a Resource: Define local networks as FireCloud resources for WireGuard-powered remote access.
• Network Management collector: An embedded agent sends asset discovery and telemetry to WatchGuard Cloud, in support of the upcoming Network Management release.
• DNS proxy idle timeout and RDP over UDP: The DNS proxy gains a connection idle timeout setting, and the default RDP policy now allows UDP 3389 as well as TCP 3389.

The release also fixes a wide range of FireCluster, VPN, networking, and management issues. See the Fireware 2026.4 release notes for the full list.

These features are available with the 2026.4 release, but are not included in the 12.12.4 or 12.5.22 firmware.

Which release is right for your Firebox

Upgrade to the latest release available for your Firebox model and Fireware branch:

Check each release's notes for supported Firebox models, known issues, and upgrade considerations before you start.

How to upgrade

Download the firmware from the WatchGuard Software Downloads Center, then follow the steps for how you manage your Firebox:

• Upgrade Fireware OS or WatchGuard System Manager for locally managed Fireboxes
• Upgrade Firmware in WatchGuard Cloud for cloud-managed Fireboxes
• Upgrade a Cloud-Managed Firebox from Fireware Web UI

Back up your configuration before you upgrade. Questions? Contact WatchGuard Support or your account representative.

Resources

• Fireware 2026.4 release notes
• Fireware 12.12.4 release notes
• Fireware 12.5.22 release notes
• Software Downloads Center
• WatchGuard PSIRT advisories

Help Center Links

• Custom Dynamic Aliases and External Threat (IOC) Feed:
  
  • https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/policies/custom_dynamic_aliases.html
• IPv6 for IKEv2 MUVPN:
  
  • https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/mvpn/ikev2/mvpn_ikev2_config_edit.html
• Certificate Generation and Renewal with Let’s Encrypt:
  
  • https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/WG-Cloud/certificates_create_csr.html
• BOVPN over WireGuard:
  
  • https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/bovpn/wireguard/bovpn_wireguard_about.html

Coming Soon...

Be on the lookout for the 2026.5 release in December, which will bring the 2026.4 features and additional new features to the following Firebox models:

• NV5
• T25 / T25-W
• T45 / T45-PoE / T45-W-PoE / T45-CW
• T85-PoE
• M290, M390, M590, M690
• M4800, M5800
• FireboxV
• Firebox Cloud

This new firmware will also support our new Firebox models:

• T115-W
• T125 / T125-W
• T145 / T145-W
• T175
• T185
• M295, M395, M495, M595, M695
• M4850, M5850, M6850