CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

WatchGuard Fireware OS SIP proxy remote code execution (9.2, pre-auth), fixed in Fireware OS 2026.4, 12.12.4 and 12.5.22

cve · CVE-2026-93857 single-source

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
WatchGuard fixes three feature-dependent unauthenticated flaws scored 9.2 in Fireware OS; no exploitation…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
8
1 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-93857, newest first. Check the date before acting on an older one.

  • Upgrade every WatchGuard Firebox to Fireware OS 2026.4, 12.12.4 or, on T15 and T35 models, 12.5.22, starting with appliances that have the Access Portal or a SIP proxy enabled or that are FireCluster members, because WatchGuard names no workaround for the three unauthenticated flaws.
    2026-10-29CVE-2026-93866 +6

Defender insights

What each entry about CVE-2026-93857 tells a defender to do, newest first.

2026-10-29NOTABLEWatchGuard fixes three feature-dependent unauthenticated flaws scored 9.2 in Fireware OS; no exploitation known

Exposure · detection

Story timeline

  1. 2026-10-29WatchGuard Fireware OS 2026.4, 12.12.4 and 12.5.22: seven of 17 fixed Fireware OS flaws are scored 9.0 or higher, among them unauthenticated memory-corruption and missing-authentication rows in the Access Portal, the SIP proxy and the FireCluster sync daemon; WatchGuard knows of no exploitation
    trending-vulnerabilitiesWatchGuard fixes three feature-dependent unauthenticated flaws scored 9.2 in Fireware OS; no exploitation known

Hunting pivots

Affected products
WatchGuard Fireware OS
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-29/watchguard-fireware-2026-4-three-preauth-rows-at-9-2 · ATT&CK page ↗

Entries about WatchGuard Fireware OS SIP proxy remote code execution (9.2, pre-auth), fixed in Fireware OS 2026.4, 12.12.4 and 12.5.22 (1)

2026-10-29 · view entry permalink →

NOTABLECVE-2026-93866 +6NATOA2

WatchGuard Fireware OS 2026.4, 12.12.4 and 12.5.22: seven of 17 fixed Fireware OS flaws are scored 9.0 or higher, among them unauthenticated memory-corruption and missing-authentication rows in the Access Portal, the SIP proxy and the FireCluster sync daemon; WatchGuard knows of no exploitation

WatchGuard's advisory listing of 2026-10-27 opens with 18 rows, 17 for Fireware OS and one for Mobile VPN with SSL Client for Windows, and seven of the 17 are scored 9.0 or higher (WatchGuard PSIRT, 2026-10-27). The fixes are in Fireware OS 2026.4, 12.12.4 and, for T15 and T35 models, 12.5.22. Three of the seven need no authentication but a specific feature. CVE-2026-93866 (9.2) is an integer overflow in the WebSocket handling of the Access Portal that lets a remote unauthenticated attacker write beyond the bounds of a heap buffer while the Access Portal is enabled (WatchGuard PSIRT, 2026-10-27). CVE-2026-93857 (9.2) is a stack buffer overflow in the SIP proxy that gives remote code execution when a SIP proxy is configured on the Firebox (WatchGuard PSIRT, 2026-10-27). CVE-2026-93865 (9.2) is missing authentication in the FireCluster synchronization daemon: a remote unauthenticated attacker invokes privileged administrative actions with a crafted request to the FireCluster management IP when clustering is enabled (WatchGuard PSIRT, 2026-10-27).

The other four need a network position. CVE-2026-112709 and CVE-2026-112710 (9.2 each) are heap overflows in the authentication service that give denial of service and possibly code execution to an attacker who controls or intercepts traffic to the configured Active Directory server and returns a crafted response (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27). CVE-2026-103594 (9.5) is a stack overflow in WireGuard configuration processing for a man-in-the-middle with TLS-decrypted access between a Firebox that acts as a FireCloud Gateway and WatchGuard Cloud (WatchGuard PSIRT, 2026-10-27). CVE-2026-103593 (9.1) is a stack overflow in the logging service that gives root code execution to a network-adjacent attacker who impersonates or intercepts traffic to the log server with a crafted certificate, in FIPS mode (WatchGuard PSIRT, 2026-10-27). Six rows affect Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 up to before 12.5.22, the WireGuard row starts at 2026.2 and 12.12, and each page states that WatchGuard is not aware of exploitation in the wild (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27).

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

WatchGuard PSIRT (CVE-2026-93866) 2026-10-27

The exploit for this vulnerability requires a SIP proxy configured on the Firebox.

WatchGuard PSIRT (CVE-2026-93857) 2026-10-27

allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

WatchGuard PSIRT (CVE-2026-93865) 2026-10-27
vulnerability29 Oct 04:42Zsingle-sourceOpen finding →
Sources: WatchGuard PSIRT (CVE-2026-93866) · WatchGuard PSIRT (CVE-2026-93857) · WatchGuard PSIRT (CVE-2026-93865) · WatchGuard PSIRT (CVE-2026-112710) · WatchGuard PSIRT (CVE-2026-112709) · WatchGuard PSIRT (CVE-2026-103594) · WatchGuard PSIRT (CVE-2026-103593) · WatchGuard PSIRT (advisory listing)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • psirt.watchguard.com8 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (8)