Multiple security vulnerabilities have been identified in WatchGuard Fireware OS, affecting versions 2025.1 through 2026.4, 12.0 through 12.12.4, and 12.0 through 12.5.22. These flaws impact critical network edge components, including the WireGuard configuration, FireCluster sync daemon, and various authentication services. The overall risk is severe, as several critical vulnerabilities allow unauthenticated attackers to execute remote code or perform privileged administrative actions, potentially compromising the entire network infrastructure.
CVE-2026-103594 (CVSS 9.5 — Critical): This vulnerability is a stack buffer overflow in the WireGuard configuration that allows for remote code execution. It requires TLS-decrypted access between the Firebox and the cloud service, enabling an attacker to exploit the flaw under specific network conditions.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in WatchGuard Fireware OS, affecting versions 2025.1 through 2026.4, 12.0 through 12.12.4, and 12.0 through 12.5.22. These flaws impact critical network edge components, including the WireGuard configuration, FireCluster sync daemon, and various authentication services. The overall risk is severe, as several critical vulnerabilities allow unauthenticated attackers to execute remote code or perform privileged administrative actions, potentially compromising the entire network infrastructure.
CVE-2026-103594 (CVSS 9.5 — Critical): This vulnerability is a stack buffer overflow in the WireGuard configuration that allows for remote code execution. It requires TLS-decrypted access between the Firebox and the cloud service, enabling an attacker to exploit the flaw under specific network conditions.[emaillocker id="1283"]
CVE-2026-93865 (CVSS 9.2 — Critical): This flaw involves missing authentication in the FireCluster sync daemon, allowing remote root action injection. An unauthenticated attacker can invoke privileged system-level administrative actions when clustering is enabled on the device.
CVE-2026-93866 (CVSS 9.2 — Critical): This is a pre-authentication integer overflow in the Access Portal that allows for an out-of-bounds write. The vulnerability is exploitable only while the Access Portal feature is enabled, permitting an attacker to corrupt memory and potentially gain control.
CVE-2026-93857 (CVSS 9.2 — Critical): This vulnerability is a pre-authentication stack buffer overflow in the SIP proxy that allows for remote code execution. It is reachable through a policy that uses the SIP proxy, allowing an unauthenticated attacker to execute arbitrary code on the system.
CVE-2026-112709 (CVSS 9.2 — Critical): This flaw is a heap buffer overflow in the AD Authentication Service that allows for pre-authentication remote code execution. Exploitation requires an attacker to have control of traffic to the Active Directory server, enabling them to trigger the overflow and execute code.
CVE-2026-112710 (CVSS 9.2 — Critical): This is another heap buffer overflow in the AD Authentication Service that allows for pre-authentication remote code execution. Similar to the previous flaw, it requires control of traffic to the Active Directory server to be exploited by an unauthenticated attacker.
CVE-2026-103593 (CVSS 9.1 — Critical): This vulnerability is a stack buffer overflow in the logging service that allows for remote code execution. An attacker can exploit this flaw to execute arbitrary code on the system, potentially leading to full compromise of the firewall appliance.
CVE-2026-90465 (CVSS 8.7 — High): This flaw involves missing authentication in FireCluster sync, which allows for privilege escalation. An unauthenticated attacker can exploit this to gain higher privileges on the system, potentially leading to administrative control.
CVE-2026-93434 (CVSS 8.7 — High): This vulnerability is an XPath injection in the SSH login process that leaks configuration data. An attacker can exploit this flaw to extract sensitive configuration information from the system, aiding in further attacks.
CVE-2026-111107: This vulnerability allows an unauthenticated attacker to crash the management service. By exploiting this flaw, an attacker can cause a denial of service, disrupting the management and monitoring capabilities of the firewall.
CVE-2026-115495: This vulnerability affects the Mobile VPN with SSL client for Windows. The specific details of the flaw are not provided in the available information, but it is part of the broader set of vulnerabilities addressed in the recent security updates.
These vulnerabilities collectively present a significant risk to network security, particularly for organizations relying on WatchGuard Firebox appliances at their network edge. The most at-risk entities are those with unpatched systems and exposed services, as the critical flaws allow for remote code execution and privilege escalation without authentication. Immediate action is required to apply the latest security updates to mitigate these risks and protect the integrity of the network infrastructure.
We recommend you to update WatchGuard Fireware OS to version 2026.4, 12.12.4, or 12.5.22 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]