WatchGuard Fireware OS: seven flaws, six critical, patch now

On 28 October 2026 INCIBE-CERT, Spain’s national CERT, published advisory INCIBE-2026-798, rated «5 – Crítica», on seven vulnerabilities in Fireware OS, the operating system of WatchGuard Firebox firewalls. Six are rated critical and one high. On the same day the Canadian Centre for Cyber Security issued advisory AV26-1094 on WatchGuard’s bulletins, and on 29 October heise Security reported the news, speaking of “several critical vulnerabilities”.

The technical details below come from the INCIBE-CERT advisory, the only one of the three that describes the individual flaws. The Canadian advisory only lists products and versions; we were not able to analyse the heise text.

What happened

According to INCIBE-CERT, the vulnerabilities were reported by the WatchGuard AI Security Research team and by Laurent Gaffie of secorizon.com. Depending on the Firebox configuration, they allow arbitrary code execution, administrative actions without authentication, memory corruption or denial of service. In the advisory’s table all seven are marked as not exploited («Explotación: No»).

The seven vulnerabilities

Four of the seven can be reached without authentication, but only with certain features enabled or under certain network conditions:

• CVE-2026-93857 (critical): stack buffer overflow in the SIP proxy. An unauthenticated remote attacker can execute code with a crafted request that passes through a policy using that proxy.
• CVE-2026-93866 (critical): integer overflow in the handling of Access Portal WebSocket connections, leading to an out-of-bounds write in a heap buffer, without authentication. Access Portal must be enabled.
• CVE-2026-93865 (critical): missing authentication in the FireCluster synchronisation service. A remote attacker can invoke privileged administrative actions with requests sent to the cluster’s management IP. FireCluster must be enabled; the title of the vendor bulletin speaks of injecting actions with root privileges.
• CVE-2026-112710 and CVE-2026-112709 (critical): two heap buffer overflows in the authentication service. The attacker must control the Active Directory server configured on the Firebox, or intercept its communications, and return a crafted response; the result is denial of service or code execution before authentication.
• CVE-2026-103594 (critical): stack buffer overflow when processing the WireGuard configuration. It only affects Fireboxes configured as FireCloud Gateway and requires a man-in-the-middle position, with access to the decrypted TLS traffic between Firebox and WatchGuard Cloud, to modify the configuration.
• CVE-2026-103593 (high): the advisory does not describe it. Among the vendor bulletins cited by INCIBE-CERT there is one on a stack buffer overflow in the logging service, the only one that does not match the six descriptions above; the advisory, however, does not explicitly link it to this CVE.

None of the sources reports CVSS scores, public exploit code or indicators of compromise.

Affected versions and fixes

According to INCIBE-CERT, Fireboxes running the following Fireware OS versions are vulnerable:

Branch	Affected versions	Fixed version
2025/2026	from 2025.1 to before 2026.4	2026.4
12.x	from 12.0 to before 12.12.4	12.12.4
12.x on T15 and T35	from 12.0 to before 12.5.22	12.5.22

CVE-2026-103594 only affects versions from 2026.2 and from 12.12 onwards, before the fixed releases, on Fireboxes configured as FireCloud Gateway.

The Canadian advisory adds a product that INCIBE-CERT does not mention: the Mobile VPN with SSL client, listed as affected in versions prior to 2026.4 and to 12.0. The advisory does not say which vulnerability affects it: for details, read WatchGuard’s bulletins.

Techniques and attack scenarios

For the SIP proxy and Access Portal flaws the scenario is MITRE ATT&CK T1190 – Exploit Public-Facing Application: a network-reachable service that can be exploited without credentials. The authentication service and WireGuard flaws instead require an intermediate position on the network (T1557 – Adversary-in-the-Middle) or control of a trusted server, meaning an attacker already inside or very close to the infrastructure. For FireCluster everything depends on who can reach the cluster’s management IP. This mapping is ours: the sources do not cite ATT&CK techniques.

Impact for European and Italian companies

The perimeter firewall is the first place an attacker would want to get into: code execution on these appliances gives visibility over the traffic, VPNs and credentials passing through them. At the moment the sources report no attacks; how much each flaw matters depends on the features enabled on each Firebox.

For entities in scope of NIS2, the update is part of the vulnerability management required by the security measures. If signs of compromise emerge, the event should be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN) and, where personal data is involved, to the data protection authority within 72 hours as required by the GDPR.

What to do now

1. Inventory: list all Fireboxes, including those at remote sites, in clusters and those managed by a provider, with model and Fireware OS version.
2. Update to 2026.4, 12.12.4 or, for T15 and T35, 12.5.22, following WatchGuard’s bulletins. Also update the Mobile VPN with SSL clients as indicated by the vendor.
3. Check the features involved: Access Portal, policies with the SIP proxy, FireCluster, Active Directory authentication, FireCloud Gateway. The ones enabled determine which flaws you are exposed to.
4. Reduce exposure until you update (general good practice, not stated in the advisory): disable Access Portal and SIP proxy policies if you don’t need them; keep the cluster management interface on a dedicated network not reachable from others; use LDAPS with certificate validation towards Active Directory.
5. Detection: look in the Firebox logs for unexpected reboots or process crashes (possible overflow attempts), unrequested configuration changes, new administrative accounts and traffic to the cluster management IP from unexpected addresses.

How ARXDOME helps

ARX Expose shows which of your company’s services are visible from the Internet, including firewall portals. ARX Radar reads the incoming traffic on the firewall every minute and flags scans and attacks in progress on the perimeter. ARX Sentry collects firewall logs and events, useful to look for anomalous reboots and configuration changes.

Last updated: 29 October 2026