WatchGuard has recently issued a crucial advisory on October 27, 2026, revealing significant security flaws in its Fireware OS. These vulnerabilities affect Firebox firewalls and could potentially lead to remote code execution, root-level action injection, and memory corruption.
Overview of Security Threats
The advisory highlights seven critical vulnerabilities among a total of 18 security issues identified across Fireware OS and the Windows Mobile VPN with SSL client. These critical flaws exhibit severity scores ranging from 9.1 to 9.5, indicating the serious nature of the threats.
In addition to the main vulnerabilities, the advisory notes other risks that could lead to exposure of configuration secrets, unauthorized file modifications, session hijacking, or disruption of firewall services. The severity of these risks varies depending on factors such as the service affected, software version, and the level of access an attacker might have.
Details of the Critical Vulnerabilities
The most severe of these vulnerabilities, CVE-2026-103594, involves a stack buffer overflow in the WireGuard configuration, allowing remote code execution. This flaw affects versions of Fireware OS from 2026.2 up to but not including 2026.4, and from 12.12 to versions prior to 12.12.4.
Two other critical flaws, CVE-2026-112709 and CVE-2026-112710, both score 9.2. They are linked to heap buffer overflows in the Active Directory authentication service, which can be exploited for remote code execution without prior authentication. Another significant vulnerability, CVE-2026-93857, affects the SIP proxy and allows for similar remote exploitation.
Additional Severe Flaws and Mitigation
Other crucial issues include CVE-2026-93865, which involves missing authentication in the FireCluster sync daemon, and CVE-2026-93866, which concerns an integer overflow in the Access Portal. Both carry a severity score of 9.2 and present significant security risks.
For most of these vulnerabilities, WatchGuard has identified fixed versions 2026.4 and 12.12.4 as solutions. Specific devices, such as T15 and T35, require version 12.5.22. Furthermore, the SSL VPN client credential-exposure issue has been resolved in version 2026.4.
Conclusion and Future Considerations
WatchGuard’s recent disclosure of these critical vulnerabilities underscores the importance of timely updates and patches to maintain network security. Organizations using affected versions should promptly apply the recommended updates to mitigate potential risks. As cybersecurity threats evolve, staying informed and proactive remains crucial for effective protection against exploitation.
