WatchGuard Outage History

Started Dec 23, 2025, 01:40 AM UTC· resolved Dec 26, 2025, 06:17 PM UTC

1. investigating Dec 23, 2025, 01:40 AM UTC

   We are currently investigating an issue of some reports of the FireCloud Windows Connection Manager not upgrading to the latest version 1.3.9.898. The symptoms from this failed upgrade may include that the Windows Connection Manager window will not render properly and the Connection Manager may fail to connect. The current mitigation is to uninstall the Connection Manager from the Single Watchguard Agent UI and then initiate an install. The next update would be in 14 hours if not sooner .

2. investigating Dec 23, 2025, 03:00 PM UTC

   We continue to investigate reports of issues with the FireCloud Windows Connection Manager upgrade to version 1.3.9.898. Our analysis has identified a problem related to file versioning, and we are also reviewing factors that may have caused an incomplete uninstallation. The team is actively performing root cause analysis to determine the full impact and scope. We'll post our next update in 8 hours, if not sooner.

3. identified Dec 23, 2025, 07:31 PM UTC

   The FireCloud Endpoint team has identified the root cause of the versioning issue and is currently testing a build that addresses this problem. The team is also continuing to investigate the cause of the unclean uninstallation. The next update will be provided at 10:00 AM EST on December 26, 2025.

4. monitoring Dec 26, 2025, 02:57 PM UTC

   A fix build has been released that addresses the file versioning issue with the FireCloud Windows Connection Manager. Windows Connection Managers will automatically upgrade to version 1.3.9.915, which resolves the issue for any impacted systems. The FireCloud team continues to monitor for any new issues to ensure system stability. We'll post our next update in 8 hours, if not sooner.

5. resolved Dec 26, 2025, 06:17 PM UTC

   This is now resolved. We apologize for any inconvenience this may have caused.

Read the full incident report →

Started Dec 10, 2025, 09:33 AM UTC· resolved Dec 10, 2025, 11:27 AM UTC

1. investigating Dec 10, 2025, 09:33 AM UTC

   We are currently investigating issues with the Administration Endpoint Security components (Aehter/Cytomic and WESS). Users are experiencing errors on new accounts creation. Our teams are working to restore normal operations and we apologize for the impact this event has caused. We'll post our next update in 60 minutes, if not sooner.

2. investigating Dec 10, 2025, 09:53 AM UTC

   Our team continue working hard on investigating the issues with the Endpoint Security Console components (Aehter/Cytomic and WESS). Users are experiencing errors accessing the administration endpoint consoles on newly created accounts. We'll post our next update in 60 minutes, if not sooner.

3. identified Dec 10, 2025, 10:25 AM UTC

   We continue to work on the issues with the Endpoint Security Console components (Aehter/Cytomic and WESS) and have identified the issue. Our teams are working to restore normal operations and we apologize for the impact this event has caused. We'll post our next update in 1 hour, if not sooner.

4. monitoring Dec 10, 2025, 10:57 AM UTC

   A fix has been implemented and we're no longer experiencing issues with Endpoint Security Console. We will continue monitoring to ensure system stability. We will post our next update in 30 minutes, if not sooner

5. resolved Dec 10, 2025, 11:27 AM UTC

   We are no longer experiencing issues with Endpoint Security Console and this incident is now resolved. All services are now operating normally. Again, we apologize for any impact this may have had on you or your customers.

Read the full incident report →

Started Dec 03, 2025, 11:58 AM UTC· resolved Dec 03, 2025, 02:30 PM UTC

1. investigating Dec 03, 2025, 11:58 AM UTC

   We're investigating alerts on Watchguard Cloud Operator Administration service. Once we determine the impact and scale of these errors we'll post our next update in 60 minutes, if not sooner.

2. identified Dec 03, 2025, 01:01 PM UTC

   We continue to work on alerts on Watchguard Cloud Operator Administration service and have identified the issue. Our teams are working to restore normal operations and we apologize for the impact this event has caused. We'll post our next update in 60 minutes, if not sooner.

3. monitoring Dec 03, 2025, 01:07 PM UTC

   Our systems show alerts on WatchGuard Cloud Operator Administration service are returning to normal and we're monitoring to ensure system stability. We'll post our next update in 30 minutes, if not sooner.

4. resolved Dec 03, 2025, 02:30 PM UTC

   We are no longer experiencing alerts on WatchGuard Cloud Operator Administration service and this incident is now resolved. The service is operating normally at this time.

Read the full incident report →

Started Dec 03, 2025, 09:48 AM UTC· resolved Dec 03, 2025, 10:33 AM UTC

1. investigating Dec 03, 2025, 09:48 AM UTC

   We're investigating alerts on Aether/Cytomic consoles service. Once we determine the impact and scale of these errors we'll post our next update in 60 minutes, if not sooner.

2. monitoring Dec 03, 2025, 10:11 AM UTC

   Our systems show alerts on Aether/Cytomic consoles service are returning to normal and we're monitoring to ensure system stability. We'll post our next update in 30 minutes, if not sooner.

3. resolved Dec 03, 2025, 10:33 AM UTC

   We are no longer experiencing alerts on Aether/Cytomic consoles service and this incident is now resolved. The service is operating normally at this time.

Read the full incident report →

Started Dec 03, 2025, 09:42 AM UTC· resolved Dec 03, 2025, 09:42 AM UTC

1. resolved Dec 03, 2025, 09:42 AM UTC

   We are no longer experiencing alerts on the access to WESS console service and this incident is now resolved. The service is operating normally at this time.

Read the full incident report →

Started Dec 02, 2025, 10:01 PM UTC· resolved Dec 04, 2025, 05:39 AM UTC

1. investigating Dec 02, 2025, 11:24 AM UTC

   We are currently investigating reports of issues on the Devices Monitor page, where information may not appear or may load slowly. Once we have determined the impact and scope of these issues, we will provide the next update within 30 minutes, or sooner if possible.

2. investigating Dec 02, 2025, 12:37 PM UTC

   We're still investigating the issues on the Devices Monitor page. We apologize for the impact this event has caused. We'll post our next update in 1 hour, if not sooner.

3. identified Dec 02, 2025, 03:02 PM UTC

   The teams has identified the issue and at the present time some customers can still experience the issue intermittently. Our team is working on mitigating actions. We apologize for the impact this event has caused. We'll post our next update in 2 hour, if not sooner.

4. identified Dec 02, 2025, 05:35 PM UTC

   Our team continue working hard on this issue, some customers can still experience problems intermittently. We'll post our next update in 2 hour, if not sooner.

5. identified Dec 02, 2025, 07:29 PM UTC

   A fix for the ongoing issue has been implemented. Recovery is in progress and may take some time to complete. Some customers may continue to experience intermittent problems during this period. We appreciate your patience and will post our next update in 2 hours, if not sooner.

6. identified Dec 02, 2025, 10:01 PM UTC

   The teams has identified the issue and at the present time some customers can still experience the issue intermittently. Our team is working on mitigating actions. We apologize for the impact this event has caused. We'll post our next update in 4 hours, if not sooner.

7. identified Dec 03, 2025, 02:03 AM UTC

   We are still working hard to resolve this event. We’ll post our next update if we have any new information. Thank you for your continued patience!

8. identified Dec 03, 2025, 05:04 AM UTC

   Our team continues to work hard on this issue, some customers can still experience problems intermittently. We'll post our next update in 4hours, if not sooner.

9. identified Dec 03, 2025, 09:03 AM UTC

   Our team continues working to fully resolve this issue. Some customers may still experience intermittent problems on the Device Monitor page. We appreciate your patience. We'll post our next update in 4 hours, if not sooner.

10. identified Dec 03, 2025, 01:09 PM UTC

    We have implemented mitigation steps. Some customers may still experience intermittent issues during this process. Thank you for your continued patience. We'll post our next update at 18:00 UTC, if not sooner.

11. identified Dec 03, 2025, 06:00 PM UTC

    Our team is continuing to work diligently to resolve the issue. Some customers may still experience intermittent problems. We appreciate your patience and will provide another update within 4 hours, or sooner if new information becomes available.

12. identified Dec 03, 2025, 09:56 PM UTC

    We have implemented mitigation steps, though some customers may still experience intermittent issues as the process continues. Thank you for your continued patience. We will post our next update in approximately 8 hours

13. monitoring Dec 04, 2025, 05:35 AM UTC

    Our systems show issues on the Device Monitor page are returning to normal and we're monitoring to ensure system stability. We'll post our next update in 30 minutes, if not sooner.

14. resolved Dec 04, 2025, 05:39 AM UTC

    We are no longer experiencing issues on the Device Monitor page and this incident is now resolved. The service is operating normally at this time.

Read the full incident report →

Started Nov 25, 2025, 04:44 PM UTC· resolved Dec 01, 2025, 08:41 AM UTC

1. investigating Nov 25, 2025, 03:33 PM UTC

   We are currently investigating reports of events not shown in Endpoint consoles. Our team is working to identify the impact and scale of the issue. We’ll provide the next update in 30m if not or sooner.

2. investigating Nov 25, 2025, 04:04 PM UTC

   We continue to work on reports of events not shown in Endpoint consoles. The issue is still under investigation, we apologize for the inconveniences and any impact this may have had on you or your customers. We'll post our next update in 1h, if not sooner.

3. investigating Nov 25, 2025, 04:44 PM UTC

   We continue to work on reports of events not shown in Endpoint consoles. The issue is still under investigation, we apologize for the inconveniences and any impact this may have had on you or your customers. We'll post our next update in 1h, if not sooner.

4. identified Nov 25, 2025, 05:00 PM UTC

   We continue to work on reports of events not shown in Endpoint consoles and have identified the issue. Our teams are working to restore normal operations and we apologize for the impact this event has caused. We'll post our next update in 1h, if not sooner.

5. identified Nov 25, 2025, 06:02 PM UTC

   We are continuing to work hard to resolve this event and are still seeing reports of events not appearing in Endpoint consoles. Our teams are actively addressing the issue to restore normal operations. We'll post our next update in 2 hours, if not sooner.

6. identified Nov 25, 2025, 08:10 PM UTC

   We are still working hard to resolve this event. We'll post our next update in 2 hours, if not sooner. Thanks for your patience.

7. identified Nov 25, 2025, 08:53 PM UTC

   A fix has been implemented, and the pending events have started arriving all at once, creating a temporary surge effect. It will take time for the system to fully recover. We’ll post our next update if we have any new information. Thank you for your continued patience!

8. identified Nov 26, 2025, 02:44 PM UTC

   A fix has been implemented, and our systems are recovering at a steady pace. Full restoration will take some time. We’ll provide another update as soon as new information becomes available. Thank you for your continued patience and understanding!

9. resolved Dec 01, 2025, 08:41 AM UTC

   We have successfully processed all the events not showing in the Endpoint consoles and this event is now resolved. All services are operating normally at this time. We sincerely apologize for any inconvenience this incident may have caused to you or your customers.

Read the full incident report →

Started Nov 24, 2025, 04:00 PM UTC· resolved Nov 24, 2025, 08:38 PM UTC

1. identified Nov 24, 2025, 04:00 PM UTC

   We’re continuing to work on the issue causing the Firebox configuration screen to display “Pending changes.” The root cause has been identified, and our teams are actively working on a fix. We apologize for any inconvenience or impact this may have had on you or your customers. We’ll share our next update in 1h, if not sooner.

2. identified Nov 24, 2025, 04:55 PM UTC

   Our teams continue to work diligently on the issue causing the Firebox configuration screen to display “Pending changes.” The root cause has been identified, and we’re actively implementing a fix. We apologize for any inconvenience or impact this may have had on you or your customers. We’ll provide the next update in 1h, if not sooner.

3. identified Nov 24, 2025, 05:56 PM UTC

   We are still working hard to resolve this event, and our teams are actively working on implementing the fix to restore normal operations. We'll post our next update in 2 hours, if not sooner. Thanks for your patience.

4. monitoring Nov 24, 2025, 08:08 PM UTC

   A fix has been implemented, and we are no longer experiencing the issue. We are monitoring the system to ensure stability. We'll post our next update in 30min, if not sooner.

5. resolved Nov 24, 2025, 08:40 PM UTC

   This incident has been resolved and the service is operating normally at this time. Again, we apologize for any impact this may have had on you or your customers.

Read the full incident report →

Started Nov 21, 2025, 10:25 AM UTC· resolved Nov 21, 2025, 03:15 PM UTC

1. investigating Nov 21, 2025, 10:25 AM UTC

   We have identified an issue causing a delay in ThreatSync Ingestion. We have implemented a fix and are monitoring the system's recovery. We'll post our next update in 8 hours, if not sooner.

2. resolved Nov 21, 2025, 03:15 PM UTC

   We are no longer experiencing delay in ThreatSync Ingestion and this incident is now resolved. The product is operating normally at this time.

Read the full incident report →

Started Nov 21, 2025, 05:17 AM UTC· resolved Nov 21, 2025, 11:13 AM UTC

1. monitoring Nov 21, 2025, 05:17 AM UTC

   We have identified an issue causing a delay in ThreatSync Ingestion. We have implemented a fix and are monitoring the system's recovery. We'll post our next update in 6 hours, if not sooner.

2. resolved Nov 21, 2025, 11:13 AM UTC

   We are no longer experiencing delay in ThreatSync Ingestion and this incident is now resolved. The product is operating normally at this time.

Read the full incident report →

Started Nov 21, 2025, 04:45 AM UTC· resolved Nov 21, 2025, 07:29 AM UTC

1. monitoring Nov 21, 2025, 04:45 AM UTC

   We have identified an issue causing a delay in ThreatSync Ingestion. We have implemented a fix and are monitoring the system's recovery. We'll post our next update in 3 hours, if not sooner.

2. resolved Nov 21, 2025, 07:29 AM UTC

   We are no longer experiencing delay in ThreatSync Ingestion and this incident is now resolved. The product is operating normally at this time.

Read the full incident report →

Started Nov 20, 2025, 09:48 PM UTC· resolved Nov 24, 2025, 03:51 PM UTC

1. identified Nov 20, 2025, 09:48 PM UTC

   On November 17th we identified and resolved a bug in our ThreatSync Core data pipeline that caused a temporary interruption in data processing. As a result, there is a gap in data for ThreatSync Core and Total MDR between Friday, November 14th, 2025, at 19:00 UTC and Sunday, November 16th, 2025, at 12:00 UTC. All systems are processing current data normally and all underlying security products (Firebox, Endpoint Security, AuthPoint, ThreatSync+ NDR, and Access Point) continued to enforce protections as designed. Core MDR telemetry collection also continued. Our team will begin restoring missing data on November 20th, except for NDR events; we will provide updates as this restoration progresses. For Managed Services, only data for Firebox, ThreatSync+ NDR, and AuthPoint were affected, detections for Endpoint Security were not affected, and as missing data is restored, our normal MDR process and SOC reviews will occur except for ThreatSync+ NDR related events. Thank you for your patience and understanding.

2. identified Nov 21, 2025, 03:16 PM UTC

   Our team has successfully restored Firebox data into ThreatSync Core and is continuing the recovery process for Endpoint Security data. We estimate Endpoint Security data will be fully restored by Saturday, November 22nd, at approximately 15:00 UTC. All systems remain fully operational, and all underlying security products (Firebox, Endpoint Security, AuthPoint, ThreatSync+ NDR, and Access Point) continue to enforce protections as designed. Core MDR telemetry collection also remains unaffected. For Managed Services, detections for Endpoint Security were not impacted. As missing data is restored, our normal MDR process and SOC reviews will occur, except for ThreatSync+ NDR-related events. We will provide further updates as restoration progresses. Thank you for your continued patience and understanding.

3. resolved Nov 24, 2025, 03:51 PM UTC

   Our teams have successfully restored Firebox, Endpoint security, and Wi-Fi data into ThreatSync Core. We estimate Authpoint data will be fully restored by Friday, November 28th. For Managed Services customers, our normal MDR processes and SOC reviews occur as data is restored into ThreatSync Core. All systems remain fully operational, and all underlying security products continue to enforce protections as designed. Thank you for your continued patience and understanding.

4. postmortem Nov 29, 2025, 12:01 AM UTC

   **Event Summary**: Between Friday, November 14th, 2025, at approximately 19:00 UTC and Sunday, November 16th, 2025, at 12:00 UTC, the WatchGuard Cloud ThreatSync Core \(TS Core\) data pipeline experienced an interruption in data processing. This interruption resulted in a data gap for both TS Core and Total MDR. The missing data has been restored. The event is resolved, and services are operating normally across all regions. **Event Findings**: At approximately 19:00 UTC on November 14th, 2025, an update was deployed to our ThreatSync Core \(TS Core\) data pipeline which introduced a software bug that escaped our automated testing. By 12:00 UTC on November 17th, a fix was deployed to all regions to resolve the software bug, and data processing resumed for all new events. During this service disruption, all underlying security products \(Firebox, Endpoint Security, AuthPoint, ThreatSync\+ NDR, and Wi-Fi\) continued to enforce protections as designed. While Core MDR telemetry collection was unaffected, Total MDR relies on TS Core for incoming events which caused delays until service was restored. Once service was restored, a gap in TS Core data during the disruption window was identified. In order to maintain reliability and avoid inconsistencies while restoring missing data, we undertook careful preparation, testing, and verification to ensure accuracy and integrity before re-ingesting and processing the data. Four areas of data backfill were completed: Firebox Visibility \(November 21, 15:12 UTC\), WatchGuard Endpoint \(November 22, 15:12 UTC\), WatchGuard Wi-Fi \(November 24, 07:00 UTC\), and AuthPoint \(November 27, 05:55 UTC\). At WatchGuard, we strive for flawless operational performance; our teams are implementing improvements to prevent recurrence and reduce re-ingestion times in the future. We sincerely apologize for the impact to our affected customers, and appreciate the opportunity to meet your security needs.

Read the full incident report →

Started Nov 20, 2025, 08:27 PM UTC· resolved Nov 21, 2025, 03:04 AM UTC

1. identified Nov 20, 2025, 08:27 PM UTC

   We have identified an issue causing approximately a 7-hour delay in Firebox log ingestion. We have implemented a fix, and our log ingestion service is currently recovering. We'll post our next update in 3 hours, if not sooner.

2. monitoring Nov 20, 2025, 11:22 PM UTC

   The issue has been mitigated and we are now monitoring our systems as they recover. We will post our next update within the next 2 hours.

3. monitoring Nov 21, 2025, 01:15 AM UTC

   We are still monitoring our systems as they recover. We will post our next update within the next 2 hours.

4. resolved Nov 21, 2025, 03:04 AM UTC

   Our systems are fully recovered and normal operations are restored. We apologize for the impact that this may have had on you, and thank you for your patience. This is now resolved.

Read the full incident report →

Started Nov 20, 2025, 07:52 PM UTC· resolved Nov 20, 2025, 08:06 PM UTC

1. investigating Nov 20, 2025, 07:52 PM UTC

   We are currently investigating issues with Watchguard Cloud Directories and Domain services. Our team is working to identify the impact and scale of the issue. We’ll provide the next update within 1 hour.

2. resolved Nov 20, 2025, 08:06 PM UTC

   We are no longer experiencing issues with Watchguard Cloud Directories and Domain services. All systems are currently operating normally. We apologize for any inconvenience this may have caused to you or your customers.

Read the full incident report →

Started Nov 07, 2025, 06:46 AM UTC· resolved Nov 07, 2025, 11:22 AM UTC

No vendor updates were posted for this incident.

Read the full incident report →