WatchGuard Patches 18 Fireware OS Vulnerabilities, Seven Rated Critical

TL;DR

WatchGuard has published 18 security advisories for its Firebox firewall platform on October 27. Seven of these WatchGuard Fireware OS vulnerabilities score 9.1 or higher on CVSS 4.0. The worst, CVE-2026-103594, reaches 9.5 and could allow code execution.

Several critical bugs let unauthenticated attackers run code or take admin actions under certain conditions. Fixes are in Fireware OS 2026.4, 12.12.4 and 12.5.22. WatchGuard’s own AI security research team found most of the flaws.

Notable CVEs

Why It Matters

Firebox appliances sit at the network edge. A compromised firewall gives an attacker a foothold inside the network. Moreover, CISA’s KEV catalog already lists earlier WatchGuard flaws exploited by attackers, so these WatchGuard Fireware OS vulnerabilities deserve fast attention.

According to the CVE records, WatchGuard AI Security Research discovered 13 of the 18 flaws. Outside researchers from CODE WHITE and secorizon.com reported several others.

How the Attack Works

Critical flaws

Most critical bugs need a specific setup, which CVSS 4.0 marks as an attack requirement. For example, CVE-2026-93865 is a missing authentication flaw in FireCluster sync. It lets a remote attacker “invoke privileged system-level administrative actions” when clustering is enabled.

Similarly, CVE-2026-93866 affects the Access Portal’s WebSocket handling. It works only “while the Access Portal feature is enabled.” Meanwhile, CVE-2026-93857 is a stack overflow in the SIP proxy, reachable through a policy that uses it.

Other critical flaws need an attacker in the middle. CVE-2026-103594 requires TLS-decrypted access between the Firebox and WatchGuard Cloud. Likewise, two heap overflows (CVE-2026-112709 and CVE-2026-112710) need control of traffic to the Active Directory server.

High and medium flaws

CVE-2026-93434 (CVSS 8.7) is an XPath injection in SSH login that leaks configuration data. In addition, CVE-2026-111107 lets an unauthenticated attacker crash the management service.

Affected Versions

• Fireware OS 2025.1 up to 2026.4
• Fireware OS 12.0 up to 12.12.4
• Fireware OS 12.0 up to 12.5.22 on the 12.5.x branch
• Mobile VPN with SSL client for Windows (CVE-2026-115495)

Patch and Mitigation

Upgrade each Firebox firewall to Fireware OS 2026.4, 12.12.4 or 12.5.22, depending on your branch. Also, update the Mobile VPN with SSL client.

Until you patch, limit management interfaces to trusted hosts. Disable Access Portal or the SIP proxy where you do not need them, and isolate FireCluster links.

So far, no exploitation or public proof-of-concept has been confirmed, and none of the flaws appear in CISA’s KEV catalog. For per-flaw details on these WatchGuard Fireware OS vulnerabilities, visit the WatchGuard PSIRT portal.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.