WatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster
WatchGuard Fireware OS (Firebox firewalls) and Mobile VPN with SSL client for Windows
On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4.
Why this severity: CVSS 4.0 up to 9.5 (CVE-2026-103594, needs a man-in-the-middle position) and 9.2 for the unauthenticated SIP proxy, Access Portal and FireCluster bugs; WatchGuard is not aware of exploitation in the wild
- Started
- Oct 27, 2026
Affected
- Fireware OS 2025.1 up to but not including 2026.4
- Fireware OS 12.0 up to but not including 12.12.4
- Fireware OS on T15 and T35: 12.0 up to but not including 12.5.22
- Mobile VPN with SSL client for Windows 12.0 up to but not including 2026.4
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15 and T35)
- Mobile VPN with SSL client 2026.4
Timeline1
Advisories7
- WatchGuard Security Advisories (Oct 27 2026 batch)WatchGuard · Oct 27, 2026
- CVE-2026-93857: Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code ExecutionWatchGuard · Oct 27, 2026
- CVE-2026-93866: Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds WriteWatchGuard · Oct 27, 2026
- CVE-2026-93865: Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action InjectionWatchGuard · Oct 27, 2026
- CVE-2026-112710: Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code ExecutionWatchGuard · Oct 27, 2026
- CVE-2026-103594: Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code ExecutionWatchGuard · Oct 27, 2026
- CVE-2026-103593: Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code ExecutionWatchGuard · Oct 27, 2026
Get an email when a new major security incident drops. No spam, unsubscribe any time.
