WatchGuard fixes 18 Fireware flaws, including critical RCE bug

WatchGuard has issued 18 Fireware OS advisories for its Firebox firewall platform, published on 27 October 2026. Seven of the flaws score 9.1 or higher on CVSS 4.0, with the most severe being CVE-2026-103594, rated 9.5, described as a stack buffer overflow in WireGuard configuration that could allow remote code execution.

The firm notes that most of the critical bugs enable unauthenticated attackers to run code or perform admin actions under specific conditions, and that none of the flaws have been publicly exploited to date according to its disclosure. Fixes are available in Fireware OS 2026.4, 12.12.4 and 12.5.22, and WatchGuard’s AI Security Research team is credited with discovering the majority of the flaws, with external researchers contributing as well.

Affected versions span Fireware OS 2025.1 up to 2026.4, Fireware OS 12.0 up to 12.12.4, and Fireware OS 12.0 up to 12.5.22 on the 12.5.x branch, including Mobile VPN with SSL client for Windows (CVE-2026-115495).

The article outlines several notable CVEs, including CVE-2026-93865 (Missing Authentication in FireCluster Sync Daemon, allowing remote root action injections), CVE-2026-93866 (Pre-Authentication overflow in Access Portal), CVE-2026-93857 (Pre-Authentication stack overflow in SIP Proxy), CVE-2026-103593 (Stack overflow in Logging Service), and others involving pre- and post-authentication flows.

The recommended response is to upgrade affected devices to Fireware OS 2026.4, 12.12.4 or 12.5.22 and, where feasible, limit management interfaces and disable unnecessary components until patched. The PSIRT portal is cited for per-flaw details.