Vulnerabilities

WatchGuard fixes seven critical Firebox flaws, some pre-auth RCE

WatchGuard’s Fireware OS 2026.4, 12.12.4 and 12.5.22 fix 18 Firebox flaws, seven critical. What UK firms and MSPs should patch first.

Shield graphic with the headline Seven critical flaws hit WatchGuard Firebox

WatchGuard has released fixes for 18 vulnerabilities in Fireware OS, the operating system on its Firebox firewalls, and seven of them are rated critical. None is known to be exploited yet, but Firebox bugs have been turned into working attacks quickly in the past, so UK organisations running these appliances should treat this as an upgrade-this-week job.

What happened

On 27 October 2026 WatchGuard’s product security team published 18 new CVEs on its PSIRT portal. Seventeen affect Fireware OS and one affects the Mobile VPN with SSL client for Windows. Seven score 9.1 or higher under CVSS 4.0. Another four score between 8.6 and 8.7, just below the critical band.

The fixes are in Fireware OS 2026.4 and 12.12.4 for the main release branches, and in 12.5.22 for the older T15 and T35 appliances, which remain on the 12.5 branch. In every advisory we checked, WatchGuard reports no known exploitation in the wild. No public proof-of-concept code has been confirmed.

Credit for the findings is split. According to SecurityOnline’s analysis, WatchGuard’s internal AI security research team found 13 of the 18 issues. WatchGuard credits external researchers with several of the others: Laurent Gaffie of secorizon.com reported the SIP proxy and Access Portal bugs, and a CODE WHITE team reported the SSH authentication flaw.

The technical picture

The headline numbers suggest something worse than the detail does. Almost every critical flaw depends on a particular feature being switched on, or on the attacker already holding a privileged network position. The seven critical issues are:

  • CVE-2026-103594 (9.5): a stack buffer overflow in how the Firebox processes WireGuard configuration. Exploiting it requires TLS-decrypted man-in-the-middle access between the appliance and WatchGuard Cloud, and it only affects boxes acting as a FireCloud Gateway on the 2026.2 and 12.12 lines.
  • CVE-2026-93857 (9.2): a stack overflow in the SIP proxy that can be reached without authentication, giving code execution when a policy routes traffic through that proxy.
  • CVE-2026-93866 (9.2): an integer overflow in the WebSocket handling behind the Access Portal. It allows an out-of-bounds heap write before login whenever the portal is enabled.
  • CVE-2026-93865 (9.2): missing authentication in the FireCluster synchronisation daemon. An unauthenticated request to the cluster management IP can trigger privileged system actions.
  • CVE-2026-112709 and CVE-2026-112710 (both 9.2): heap overflows in the authentication service. Anyone able to impersonate or sit in the path between the firewall and its configured Active Directory server could feed it a crafted reply.
  • CVE-2026-103593 (9.1): a stack overflow in the logging service, triggered by a crafted certificate. It applies to appliances in FIPS mode that send logs to an external server.

Three of the high-rated issues also stand out. CVE-2026-90465 (8.7) is a second FireCluster authentication gap that lets someone on the cluster interconnect run management actions as root. CVE-2026-93434 (8.7) is an XPath injection reachable through the SSH login, which can leak configuration secrets to anyone who can reach the management SSH interface, with no credentials needed. CVE-2026-111107 (8.7) lets an unauthenticated attacker repeatedly crash the management service and drop administrator sessions.

Checklist of six priority actions for patching WatchGuard Firebox firewalls against the October 2026 Fireware OS flaws

Why it matters for UK organisations

WatchGuard has a large footprint in the UK small and mid-sized business market, and much of it is supplied and run by managed service providers. So the people responsible for patching are often a step removed from the business that owns the risk. Many of these boxes are the only perimeter control between a small firm and the internet, and they also terminate remote-access VPNs.

History matters here as well. In December 2025 CISA added CVE-2025-14733, an exploited Firebox remote code execution flaw, to its Known Exploited Vulnerabilities catalogue a day after the patch shipped. BleepingComputer reported that Shadowserver was then still counting more than 117,000 unpatched instances online. Attackers clearly watch this product line, and reverse-engineering a firmware diff is well within the reach of criminal groups.

The features at the centre of this release are not exotic either. FireCluster is how many organisations get high availability. Active Directory authentication is the normal way to tie firewall policy to users. SIP proxies are still common wherever on-premises telephony survives. For organisations working towards the Cyber Security and Resilience Bill’s expectations, or simply keeping Cyber Essentials, an unpatched internet-facing firewall with a known critical flaw is exactly what an assessor or an insurer will ask about.

Expert view

When we test perimeter estates, the firewall is often the most neglected box on the network. It gets configured once, works, and is then left alone because nobody wants to risk an outage. That habit is what turns a vendor advisory into a breach. In my experience the hard part is rarely the upgrade itself. It is finding out which features are actually enabled across dozens of appliances that an MSP inherited from someone else.

I would not panic about the WireGuard bug despite its 9.5 score. Needing decrypted access to the cloud management channel is a high bar. I would be far more concerned about the Access Portal and SIP proxy flaws, which can be reached from the internet before any login. The FireCluster issues come next, because cluster interconnects are frequently cabled through ordinary switches rather than kept physically separate. The AD authentication bugs are a reminder that the firewall trusts its directory, so an attacker already inside the network gains a route to the edge device.

It is also worth noticing that a vendor’s own AI-assisted research produced most of this batch. That is good news for defenders, but it also suggests that attackers’ tooling could find similar bugs. Plan patch windows for more frequent, larger firmware advisories from every network vendor.

What to do now

  1. Inventory first. List every Firebox, its Fireware version and branch, and whether Access Portal, SIP proxy, FireCluster, FireCloud Gateway, AD authentication or FIPS mode with external logging is enabled.
  2. Upgrade to the fixed builds. That means 2026.4 or 12.12.4 for most models and 12.5.22 for T15 and T35. Prioritise boxes with Access Portal or SIP proxy exposed to the internet. This is the Cyber Essentials security update management control, and critical fixes should land within 14 days.
  3. Cut exposure while you wait. Disable Access Portal and the SIP proxy where they are not needed, and restrict management web and SSH interfaces to trusted admin hosts only, in line with the firewall and secure configuration controls.
  4. Isolate cluster links. Keep FireCluster interconnects on dedicated, physically or logically separated segments.
  5. Update Mobile VPN with SSL clients on Windows to 2026.4. CVE-2026-115495 lets a local attacker read VPN credentials from loopback traffic.
  6. Check your MSP contract. If a provider manages your firewalls, ask in writing for the upgrade date and evidence of the installed version.
  7. Watch for exploitation. Monitor the CISA KEV catalogue and NCSC alerts, and review appliance logs for crashes of management or authentication services.

Bottom line

This is a big release, but most of the critical bugs depend on specific configuration rather than being open to everyone. That makes the inventory step the real work. Find out which of your Fireboxes run Access Portal, SIP proxy or clustering, patch those first, and get every appliance onto 2026.4, 12.12.4 or 12.5.22 before someone turns the patch diff into an exploit.

Sources

Related Posts