WatchGuard Fireware OS 2026.4, 12.12.4 and 12.5.22: seven of 17 fixed Fireware OS flaws are scored 9.0 or higher, among them unauthenticated memory-corruption and missing-authentication rows in the Access Portal, the SIP proxy and the FireCluster sync daemon; WatchGuard knows of no exploitation
WatchGuard fixes three feature-dependent unauthenticated flaws scored 9.2 in Fireware OS; no exploitation known
Defender actions
- Upgrade every WatchGuard Firebox to Fireware OS 2026.4, 12.12.4 or, on T15 and T35 models, 12.5.22, starting with appliances that have the Access Portal or a SIP proxy enabled or that are FireCluster members, because WatchGuard names no workaround for the three unauthenticated flaws.
Analysis
WatchGuard's advisory listing of 2026-10-27 opens with 18 rows, 17 for Fireware OS and one for Mobile VPN with SSL Client for Windows, and seven of the 17 are scored 9.0 or higher (WatchGuard PSIRT, 2026-10-27). The fixes are in Fireware OS 2026.4, 12.12.4 and, for T15 and T35 models, 12.5.22. Three of the seven need no authentication but a specific feature. CVE-2026-93866 (9.2) is an integer overflow in the WebSocket handling of the Access Portal that lets a remote unauthenticated attacker write beyond the bounds of a heap buffer while the Access Portal is enabled (WatchGuard PSIRT, 2026-10-27). CVE-2026-93857 (9.2) is a stack buffer overflow in the SIP proxy that gives remote code execution when a SIP proxy is configured on the Firebox (WatchGuard PSIRT, 2026-10-27). CVE-2026-93865 (9.2) is missing authentication in the FireCluster synchronization daemon: a remote unauthenticated attacker invokes privileged administrative actions with a crafted request to the FireCluster management IP when clustering is enabled (WatchGuard PSIRT, 2026-10-27).
The other four need a network position. CVE-2026-112709 and CVE-2026-112710 (9.2 each) are heap overflows in the authentication service that give denial of service and possibly code execution to an attacker who controls or intercepts traffic to the configured Active Directory server and returns a crafted response (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27). CVE-2026-103594 (9.5) is a stack overflow in WireGuard configuration processing for a man-in-the-middle with TLS-decrypted access between a Firebox that acts as a FireCloud Gateway and WatchGuard Cloud (WatchGuard PSIRT, 2026-10-27). CVE-2026-103593 (9.1) is a stack overflow in the logging service that gives root code execution to a network-adjacent attacker who impersonates or intercepts traffic to the log server with a crafted certificate, in FIPS mode (WatchGuard PSIRT, 2026-10-27). Six rows affect Fireware OS 2025.1 up to before 2026.4 and 12.0 up to before 12.12.4, T15 and T35 up to before 12.5.22, the WireGuard row starts at 2026.2 and 12.12, and each page states that WatchGuard is not aware of exploitation in the wild (WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27; WatchGuard PSIRT, 2026-10-27).
Cited evidence
WatchGuard is not aware of any exploitation of this vulnerability in the wild.
allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
The exploit for this vulnerability requires a SIP proxy configured on the Firebox.
allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Sources8
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.