CVE-2026-938659.2Critical
Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
WatchGuard · Fireware OS
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.2CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 28 Oct.
- WatchGuard fixes 18 Fireware flaws, including critical RCE bugSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.