WatchGuard disclosed a set of serious vulnerabilities in Fireware OS on October 27, 2026, revealing seven critical defects that, in some cases, allow remote code execution or root-level actions without prior authentication. The advisory is part of a broader release covering 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client, with the seven critical entries carrying CVSS scores between 9.1 and 9.5. Where noted, attackers can trigger vulnerable code before logging in, elevating the urgency for detection and remediation.
What WatchGuard disclosed
WatchGuard’s indexed advisory lists seven critical Fireware OS vulnerabilities that span components such as WireGuard, Active Directory authentication, SIP proxy, logging services, FireCluster synchronization, and the Access Portal. Several of these flaws permit execution of code remotely or allow memory corruption; others enable unauthorized root-level actions or file modifications. The release also includes lower-scored issues that still allow authenticated or local attackers to gain root-level file access.
Details of the critical flaws
The highest-rated issue, CVE-2026-103594 (CVSS 9.5), is described as a stack buffer overflow in the WireGuard configuration implementation and can enable remote code execution. Affected ranges cited include Fireware OS 2026.2 up to (but not including) 2026.4, and 12.12 up to (but not including) 12.12.4.
Two additional high-severity flaws, CVE-2026-112709 and CVE-2026-112710 (each CVSS 9.2), are heap buffer overflows in the Active Directory authentication service that allow remote code execution before authentication completes. CVE-2026-93857 (CVSS 9.2) impacts the SIP proxy via a stack buffer overflow exploitable prior to authentication. CVE-2026-103593 (CVSS 9.1) affects the logging service with a stack buffer overflow that can be leveraged for remote code execution. CVE-2026-93865 (CVSS 9.2) concerns missing authentication in the FireCluster sync daemon and can permit remote root action injection. CVE-2026-93866 (CVSS 9.2) is an integer overflow in the Access Portal that produces an out-of-bounds write and memory corruption; code execution has not been confirmed for this issue.
Critical Flaws:
| CVE ID | CVSS | Component | Vulnerability |
|---|---|---|---|
| CVE-2026-103594 | 9.5 | WireGuard | Stack buffer overflow |
| CVE-2026-112710 | 9.2 | Active Directory service | Heap buffer overflow |
| CVE-2026-112709 | 9.2 | Active Directory service | Heap buffer overflow |
| CVE-2026-93865 | 9.2 | FireCluster daemon | Missing authentication |
| CVE-2026-93857 | 9.2 | SIP proxy | Stack buffer overflow |
| CVE-2026-93866 | 9.2 | Access Portal | Integer overflow |
| CVE-2026-103593 | 9.1 | Logging service | Stack buffer overflow |
Other notable issues
Two additional vulnerabilities allow file modification or overwrites as root: CVE-2026-90464 permits an authenticated attacker to modify arbitrary files as root due to missing command validation, and CVE-2026-93864 allows a local attacker to overwrite arbitrary files as root through a link-following flaw in firewalld. Prior WatchGuard Firebox OS reports covered separate authenticated code-execution and file-write issues; those should not be conflated with the vulnerabilities in this advisory.
Affected versions and fixes
For many of the Fireware OS issues in this release, WatchGuard’s advisory identifies 2026.4 and 12.12.4 as fixed versions. Where applicable, T15 and T35 devices require version 12.5.22. The Windows SSL VPN client credential-exposure issue is also listed as fixed in 2026.4. The reporting notes that full advisory pages could not be retrieved during verification; beyond the indexed confirmation, the October disclosure details and specific patch versions should be confirmed directly against vendor advisories before taking final action.
Recommendations for SOCs
Provide your SOC teams with alert context and prioritize investigation of any anomalous activity related to the affected services (WireGuard, AD auth, SIP proxy, logging, FireCluster sync, Access Portal). Integrate threat intelligence feeds where available—WatchGuard’s notice suggests correlating with broader telemetry (the advisory references integrating Threat Intel from 16K SOCs)—to speed detection and containment of potential exploitation.
Conclusion
This advisory lists multiple critical vulnerabilities in WatchGuard Fireware with several allowing pre-authentication remote code execution and others permitting root-level modifications. Confirm patched versions directly with WatchGuard advisories, notify affected owners, and supply SOCs with contextual alerts and threat intelligence to reduce the risk of successful exploitation. Note that previously exploited WatchGuard zero-day CVE-2025-14733 is separate from these newly listed flaws.
Licensed under CC BY-ND 4.0 International