CVE-2026-78008

CVE-2026-78008 is a buffer overflow (out-of-bounds write, CWE-787) in the Management Web UI of WatchGuard's Fireware OS, the operating system that runs on the company's Firebox firewall appliances. An attacker who is already an authenticated administrator and has network access to the management interface can send specially crafted traffic that overflows a buffer, crashing the device or, in some conditions, executing arbitrary code. Because CVSS 4.0 rates this with high privileges required (PR:H) and unchanged scope, the impact is confined to the appliance itself and the attacker must already hold administrator credentials, for example through a compromised, reused, or leaked admin account. All Firebox deployments running a vulnerable Fireware OS release with the management Web UI reachable are affected; the available data does not specify which version ranges are vulnerable, so defenders should consult WatchGuard's advisory for the affected and fixed releases. There is currently no evidence of exploitation: the flaw is not in CISA's KEV, no public proof of concept is known, and EPSS assigns roughly a 0.4% chance of exploitation within 30 days (30th percentile).

What to do: Review WatchGuard's security advisory for CVE-2026-78008 to identify affected and fixed Fireware OS releases and upgrade each Firebox accordingly. As interim mitigation, restrict the Management Web UI to trusted administrative networks (dedicated management interface or interface access rules), avoid exposing it to the WAN, and audit which accounts hold administrator rights, enforcing strong credentials and MFA where available. Since no exploitation is known and no PoC is public, this fits a normal patch cycle, but check appliance logs for unexpected restarts or admin-account anomalies in the meantime.