# WatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster · pwn.watch > On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4. Page: https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026 · generated 2026-10-27T18:18:44.616Z ## Status - Severity: critical · status: live · patch: patched - Product: WatchGuard Fireware OS (Firebox firewalls) and Mobile VPN with SSL client for Windows - Started: 2026-10-27 - CVEs: CVE-2026-93857, CVE-2026-93866, CVE-2026-93865, CVE-2026-112709, CVE-2026-112710, CVE-2026-103593, CVE-2026-103594, CVE-2026-90465, CVE-2026-93434, CVE-2026-111107, CVE-2026-90442, CVE-2026-93862, CVE-2026-90464, CVE-2026-93864, CVE-2026-113881, CVE-2026-104381, CVE-2026-82332, CVE-2026-115495 - Affected: Fireware OS 2025.1 up to but not including 2026.4; Fireware OS 12.0 up to but not including 12.12.4; Fireware OS on T15 and T35: 12.0 up to but not including 12.5.22; Mobile VPN with SSL client for Windows 12.0 up to but not including 2026.4 - Fixed in: Fireware OS 2026.4; Fireware OS 12.12.4; Fireware OS 12.5.22 (T15 and T35); Mobile VPN with SSL client 2026.4 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026.json - This file: https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: WatchGuard publishes 18 advisories: 17 Fireware OS flaws (pre-auth RCE in the SIP proxy CVE-2026-93857, Access Portal CVE-2026-93866, unauthenticated FireCluster root actions CVE-2026-93865, AD authentication heap overflows CVE-2026-112709 and CVE-2026-112710, logging service CVE-2026-103593, WireGuard config CVE-2026-103594 at CVSS 9.5) plus a Mobile VPN with SSL client credential leak, all fixed in 2026.4, 12.12.4 and 12.5.22, with no known exploitation. (https://psirt.watchguard.com/) ## Fix brief # Security brief: WatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster Source: https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026 · status: live · severity: critical · updated Oct 27, 2026, 16:19 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4. Severity detail: CVSS 4.0 up to 9.5 (CVE-2026-103594, needs a man-in-the-middle position) and 9.2 for the unauthenticated SIP proxy, Access Portal and FireCluster bugs; WatchGuard is not aware of exploitation in the wild - Product: WatchGuard Fireware OS (Firebox firewalls) and Mobile VPN with SSL client for Windows - CVE / advisory ids: CVE-2026-93857, CVE-2026-93866, CVE-2026-93865, CVE-2026-112709, CVE-2026-112710, CVE-2026-103593, CVE-2026-103594, CVE-2026-90465, CVE-2026-93434, CVE-2026-111107, CVE-2026-90442, CVE-2026-93862, CVE-2026-90464, CVE-2026-93864, CVE-2026-113881, CVE-2026-104381, CVE-2026-82332, CVE-2026-115495 ## Affected versions - Fireware OS 2025.1 up to but not including 2026.4 - Fireware OS 12.0 up to but not including 12.12.4 - Fireware OS on T15 and T35: 12.0 up to but not including 12.5.22 - Mobile VPN with SSL client for Windows 12.0 up to but not including 2026.4 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Fireware OS 2026.4 - Fireware OS 12.12.4 - Fireware OS 12.5.22 (T15 and T35) - Mobile VPN with SSL client 2026.4 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 27, 2026: WatchGuard publishes 18 advisories: 17 Fireware OS flaws (pre-auth RCE in the SIP proxy CVE-2026-93857, Access Portal CVE-2026-93866, unauthenticated FireCluster root actions CVE-2026-93865, AD authentication heap overflows CVE-2026-112709 and CVE-2026-112710, logging service CVE-2026-103593, WireGuard config CVE-2026-103594 at CVSS 9.5) plus a Mobile VPN with SSL client credential leak, all fixed in 2026.4, 12.12.4 and 12.5.22, with no known exploitation. ## Advisories - [WatchGuard Security Advisories (Oct 27 2026 batch)](https://psirt.watchguard.com/) (WatchGuard) - [CVE-2026-93857: Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution](https://psirt.watchguard.com/CVE-2026-93857/) (WatchGuard) - [CVE-2026-93866: Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write](https://psirt.watchguard.com/CVE-2026-93866/) (WatchGuard) - [CVE-2026-93865: Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection](https://psirt.watchguard.com/CVE-2026-93865/) (WatchGuard) - [CVE-2026-112710: Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution](https://psirt.watchguard.com/CVE-2026-112710/) (WatchGuard) - [CVE-2026-103594: Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution](https://psirt.watchguard.com/CVE-2026-103594/) (WatchGuard) - [CVE-2026-103593: Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution](https://psirt.watchguard.com/CVE-2026-103593/) (WatchGuard) --- Machine-readable: https://pwn.watch/i/watchguard-fireware-2026-4-security-update-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.