WatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster ยท updates https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026 On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4. en Tue, 27 Oct 2026 00:00:00 GMT WatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster: WatchGuard publishes 18 advisories: 17 Fireware OS flaws (pre-auth RCE in the SIP proxy CVE-2026-93857, Access Portal CVE-2026-93866, unauthenticated FireCluster root actions CVE-2026-93865, AD authentication heap overflows CVE-2026-112709 and CVE-2026-112710, logging service CVE-2026-103593, WireGuard config CVE-2026-103594 at CVSS 9.5) plus a Mobile VPN with SSL client credential leak, all fixed in 2026.4, 12.12.4 and 12.5.22, with no known exploitation. https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026 https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026#2026-10-27-ad79e116 Tue, 27 Oct 2026 00:00:00 GMT critical <p><a href="https://psirt.watchguard.com/">Source</a></p>