Knowledge Base Digest - July 2026

Articles

• Cannot use domain list entries with wildcards or URL path suffixes in DNSWatch in WatchGuard Cloud 
• Missing dueDateTime default value in Autotask causes PSA Ticketing error in WatchGuard Cloud Audit Log message 
• Encrypted Client Hello (ECH) bypasses WebBlocker settings in an HTTPS proxy policy 
• Firebox Cloud support for Microsoft Azure Network Adapter (MANA) 
• Client capability fields missing in authentication failure events when using WPA3  
• FireCloud mobile app disconnects when I switch between wi-fi and mobile data 

Known Issues

• IntelligentAV detections classified as Suspicious are not included in Malware statistics on the Device Summary page 
• When I log in to a Windows computer, there is a delay before the AuthPoint MFA screen appears 
• When I log in to a Windows computer, there is a delay before the AuthPoint MFA screen appears 
• On the Front Panel tab in FSM, the Status and Traffic indicators do not show activity 
• PPPoE discovery packets on external VLAN not marked with 802.1p priority 
• SNMP OID query changes after upgrade to access point firmware v3.1 or higher 
• WatchGuard access points incorrectly generate Evil Twin AP alerts 
• Captive portal bypassed on IPv6 enabled networks 
• Scheduled firmware upgrades do not upgrade devices when the firmware build differs 
• WatchGuard Cloud does not show alerts for AuthPoint LDAP syncs if there are no changes 
• Firebox M4850, M5850, M6850 cannot generate fault report after system crash
• Interface LED indicators remain lit after disabling built-in 10G, 25G, and 100G interfaces on the Firebox M4850, M5850, and M6850 
• Link Aggregation (LA) does not function correctly on 25G OCP Module on Firebox M4850, M5850, M6850 
• AuthPoint users get error code 402.003.315 or 400.001.303 when they authenticate with push or activate a token 
• Fireware Web UI displays FireCluster monitored LAG interface status as "unavailable" 
• Firebox logs frequent DIM "FOREIGN KEY / UNIQUE Constraint Failed" errors 
• FireCluster file objects show "Unmatched" status for Hostile Sites and Ports with Blocked Sites List 
• ConnectWise integration authentication failure loop causes memory leak 
• Mobile VPN with IKEv2 profile download fails when Phase 1 settings use a DH group higher than Group 14 
• Firebox T45-CW IMEI sticker label error prevents 5G cellular modem activation with provider
• FireCluster status displays "Not Synchronized" or blank in Fireware Web UI 
• New passkey registration fails for SAML resources when the IdP Portal is not configured 
• USB auto-restore fails in recovery mode 
• Removal of VLAN on interface can cause remaining VLAN to stop responding
• Firebox M395 FireCluster identifies backup master as Idle and prevents failover from WatchGuard Cloud

Known Issues

• FQDN policies do not work after a Firebox reboot
• Unable to create a new external interface VLAN configuration from the local Web UI of a cloud-managed Firebox
• Cannot remove groups with long names from AuthPoint group syncs
• Cannot remove groups with long names from Zero Trust policies
• Firebox truncates RADIUS State attribute with embedded null characters
• Cannot change the order of Mobile VPN authentication servers for a cloud-managed Firebox
• Patch Management or Vulnerability Assessment show Error 29 on macOS and Linux and Error -2147020579 on Windows
• Content Inspection with self-signed or untrusted CA certificates generates warning that cannot be bypassed
• Firebox Cloud: Cannot delete SD-WAN action
• Cannot Reorder ThreatSync Automation Policies
• Helpdesk operators cannot access devices when assigned to specific account groups
• Firebox T25-W network service crashes when wireless mode set to 802.11ax on 5 GHz radio
• WatchGuard Cloud Scheduled Report History shows "Report Failed" then "Completed"

Articles

• Are Dimension and WebBlocker Server affected by the Linux kernel vulnerabilities (CVE-2026-23268 and CVE-2026-23269)?
• ThreatSync remediation response actions do not block wireless client connections to some types of malicious access points
• Block or disable weak CBC ciphers for Firebox web server
• Connections to Policy Manager or System Manager Fail with FireCloud
• About WMM/QoS support on WatchGuard access points managed in WatchGuard Cloud
• Access point channel changes due to DFS, ACS, or DCS do not immediately show the new channel

Known Issues

• Zero-touch deployment fails for new cloud-managed Fireboxes
• Firebox generates large number of wireguard-wrap log messages
• Sending Firebox fault reports to WatchGuard returns an error
• Incident occurrence count may appear lower than actual occurrence count
• Bridge interface subnet changes require restart to update Mobile VPN with SSL configuration
• DNSWatch Dashboards in WatchGuard Cloud fail to load
• Configure wireless interfaces when Firebox configured in bridge mode
• When the Mobile VPN with SSL client log level is Debug, the VPN tunnel is unusable
• RESTful API authentication fails when the API password includes a colon
• Incorrect Zero-Trust Application Service protection error shows when network protections are disabled
• BOVPN import fails when configuration file contains a virtual interface VPN with a subnet mask as the remote virtual IP
• Cannot save Authentication Servers settings when SAML IdP Name contains spaces
• Global Domain Feed results do not accurately show in DNSWatch in WatchGuard Cloud domain search results
• Apple iOS devices show "No usable data found" error when scanning QR code for SSID that uses OWE security
• Fireware Web UI responds slowly when you manage users on Fireboxes with many Firebox-DB users
• FireCluster upgrade failures due to full system storage partition