WatchGuard fixes 18 Fireware flaws, seven rated 9.0 or higher

WatchGuard fixes 18 Fireware flaws, seven rated 9.0 or higher

27 October 2026: WatchGuard has published 18 security advisories for Fireware OS, the software on its Firebox firewalls, and for its Mobile VPN with SSL client for Windows. Seven carry a CVSS score of 9.0 or higher, three allow remote code execution before authentication, and the highest, CVE-2026-103594, scores 9.5. The fixes are in Fireware OS 2026.4 and 12.12.4, and in 12.5.22 for the T15 and T35 models. The advisory pages do not report any exploitation.

Not yet independently verified. WatchGuard's advisory pages do not say whether any of the 18 flaws has been exploited, and we have not seen a workaround stated for them. Version ranges are as printed on the pages; we have not tested the fixed builds. We will update this when it can be confirmed, and remove this note.

All 18 were published on WatchGuard's product security incident response site on the same day.

The seven flaws scoring 9.0 or higher

CVE-2026-103594 (9.5) is a stack buffer overflow in the way Fireware handles WireGuard configuration, and it can lead to remote code execution. It affects 2026.2 up to but not including 2026.4, and 12.12 up to but not including 12.12.4, so older release lines are not exposed.

Two flaws share a title and a score of 9.2: CVE-2026-112709 and CVE-2026-112710 are heap buffer overflows in the Active Directory authentication service that allow remote code execution before authentication. CVE-2026-93857 is a stack overflow in the SIP proxy with the same pre-authentication result, and CVE-2026-93866 is an integer overflow in the Access Portal that allows an out-of-bounds write, also before authentication. The fifth 9.2 entry, CVE-2026-93865, is missing authentication in the FireCluster sync daemon that lets a remote attacker inject actions that run as root. CVE-2026-103593 (9.1) is a stack overflow in the logging service that allows remote code execution.

The rest of the batch

Below 9.0 sit three flaws at 8.7: CVE-2026-90465, missing authentication in FireCluster sync that allows privilege escalation; CVE-2026-93434, an XPath injection in SSH authentication that lets an attacker extract configuration secrets by blind extraction; and CVE-2026-111107, a null pointer dereference in the management interface that crashes the device without authentication. CVE-2026-90442 (8.6) is a crash in the certificate service for authenticated users. Two 7.2 scores cover an out-of-bounds read in FireCluster sync and root-level file modification by an authenticated user, CVE-2026-93864 (7.1) is a local file overwrite as root, and the remainder score 6.1 or lower, including AuthPoint session hijacking (CVE-2026-82332, 5.6).

Which builds are fixed

The main ranges start at 2025.1 on the 2025 line and at 12.0 on the older line. Most advisories list the same span: 2025.1 up to 2026.4, and 12.0 up to 12.12.4, with T15 and T35 hardware covered from 12.0 up to 12.5.22. Several entries begin later, at 12.7, 12.9, 12.12 or 2026.2, so a device on a recent build may be exposed to fewer of them.

• Fireware OS 2026.4: fixed on the current release line.
• Fireware OS 12.12.4: fixed on the 12.x line.
• Fireware OS 12.5.22: fixed for T15 and T35 appliances.
• Mobile VPN with SSL client for Windows: CVE-2026-115495 (5.7) exposes VPN credentials in clear text over a local management socket, fixed in 2026.4.

Where to look first

Features that listen on the network are the ones to check: the Active Directory authentication service, the SIP proxy, the Access Portal and the management interface all appear in the high scores. Administrators who run FireCluster have four entries to work through, covering missing authentication, a denial of service and an out-of-bounds read in the sync service. Teams that do not use WireGuard, SIP or the Access Portal still need the upgrade, because the cluster, SSH and management flaws apply by version.

Our network security software category lists 6 products in the same field.

Sources

• WatchGuard PSIRT: security advisories published 27 October 2026, 27 October 2026