CVE-2026-938669.2Critical
Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
WatchGuard · Fireware OS
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.2CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 28 Oct.
- WatchGuard fixes 18 Fireware flaws, including critical RCE bugSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.