23rd December 2025 Cyber Update: Critical WatchGuard Flaw Under Active Attack

Farewell to 2025 from the Cyber News Centre team

As we close out 2025, this marks our final cyber editorial for the year. It has been an absolute pleasure bringing you consistent updates and objective perspectives on cyber threats, risks, emerging technologies and artificial intelligence. We look forward to continuing the conversation in the new year as we track innovation and work toward a safer digital world. Thank you for reading, supporting and staying vigilant with us.

Cyber Update – 23rd December 2025

The Australian Cyber Security Centre (ACSC) has issued a critical alert for a zero-day vulnerability in WatchGuard Firebox firewalls that is under active exploitation by threat actors. WatchGuard, an American cybersecurity company, provides network security appliances to over 250,000 businesses worldwide. Their Firebox products are designed to protect networks from external threats by controlling all inbound and outbound traffic.

The Update and Why It Matters

Update: A critical zero-day vulnerability, identified as CVE-2025-14733, has been discovered in WatchGuard Firebox firewalls and is being actively exploited in the wild. The Australian Cyber Security Centre (ACSC) issued a critical alert on December 22, 2025, urging all Australian organisations to take immediate action.

The vulnerability is an out-of-bounds write issue in the Fireware operating system's IKE daemon, which can be triggered by a remote, unauthenticated attacker to achieve arbitrary code execution. The flaw affects devices running Fireware OS versions 11.x, 12.x, and 2025.1. According to security researchers at Shadowserver, over 115,000 devices remain unpatched and exposed online globally.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by December 26. WatchGuard has released security updates and provided indicators of compromise to help organisations identify and remediate affected devices. The vendor has confirmed that the flaw is being targeted as part of a broader campaign against edge networking equipment from multiple vendors.

Why it Matters: The active exploitation of a critical, unauthenticated remote code execution vulnerability in a widely used security appliance like the WatchGuard Firebox represents a significant threat to Australian organisations. These firewalls are the first line of defence for many businesses, including those in critical infrastructure sectors. A compromise could allow attackers to gain a foothold within a network, bypass security controls, exfiltrate sensitive data, or deploy ransomware.

The fact that this is a zero-day vulnerability means that attackers were able to exploit it before a patch was available, increasing the risk for organisations. The ACSC's urgent alert underscores the seriousness of the threat and the need for immediate action. This incident also highlights the ongoing trend of attackers targeting edge devices and the importance of robust vulnerability management programs.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.