WatchGuard discloses seven critical Fireware OS flaws enabling remote code execution
Original title: WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks
Supplied data names Fireware OS 2026.4 and 12.12.4 as fixes; this report does not establish exploitation.
WatchGuard's October 27, 2026 advisory lists seven critical Fireware OS flaws in Firebox firewalls, scored 9.1 to 9.5, within a release covering 18 issues. Several allow remote code execution before authentication through buffer overflows in WireGuard, Active Directory authentication, the SIP proxy, and logging. Others affect FireCluster synchronization and Access Portal. The report says an earlier exploited zero-day, CVE-2025-14733, is separate and does not show attacks on this release.
Unconfirmed: Full advisory pages were not retrieved, so disclosure details and patch versions still need confirmation.
- CVE-2026-103594 scores 9.5 for a WireGuard stack buffer overflow enabling remote code execution.
- CVE-2026-112709 and CVE-2026-112710 score 9.2 and need no login.
- CVE-2026-93865 scores 9.2 and allows remote root action injection in FireCluster sync.
- T15 and T35 devices require 12.5.22 where that fix applies.
- The Windows SSL VPN client credential-exposure issue is fixed in 2026.4.
Impact: Remote code execution, root action injection, or memory corruption
| Product | Affected | Fixed in |
|---|---|---|
| WatchGuard Fireware OS | 2026.2 through before 2026.4; 12.12 through before 12.12.4 | 2026.4 and 12.12.4; T15 and T35 require 12.5.22 |
| WatchGuard Windows Mobile VPN with SSL | — | 2026.4 |
- 1.Update most listed Fireware OS issues to 2026.4 or 12.12.4.
- 2.Install 12.5.22 on T15 and T35 devices where applicable.
- 3.Update the Windows SSL VPN client to 2026.4.
- CVEs
- CVE-2026-103594CVE-2026-112709CVE-2026-112710CVE-2026-93857CVE-2026-93865CVE-2026-93866CVE-2026-103593CVE-2026-90464CVE-2026-93864
- Vendors
- WatchGuard
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103593 | Stack buffer overflow in Fireware OS logging service | 7.1 | — | ||
| CVE-2026-103594 | Stack buffer overflow in Fireware OS WireGuard config via MITM | 9.5 group max | — |
From the original article
2 min read at cybersecuritynews.com
WatchGuard disclosed seven critical Fireware OS vulnerabilities in an October 27, 2026 advisory, affecting Firebox firewalls and potentially enabling remote code execution, root-level action injection, and memory corruption. They are part of a wider release that covers 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client. The seven critical entries […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.