WatchGuard Patches Seven Critical Firewall Vulnerabilities, Including RCE Flaws
WatchGuard has addressed seven critical vulnerabilities in its Fireware OS, with several allowing pre-authentication remote code execution and root-level attacks.
WatchGuard has issued an urgent advisory detailing seven critical vulnerabilities discovered within its Fireware OS, impacting its range of Firebox firewalls. These flaws, rated with CVSS scores between 9.1 and 9.5, pose significant risks, including remote code execution (RCE), root-level action injection, and memory corruption. The vulnerabilities are part of a larger security update that also covers 18 other issues across Fireware OS and the Windows Mobile VPN with SSL client.
The most severe vulnerability, identified as CVE-2026-103594, carries a CVSS score of 9.5. It stems from a stack buffer overflow within the WireGuard configuration and allows for remote code execution. This flaw affects Fireware OS versions from 2026.2 up to, but not including, 2026.4, and version 12.12 up to, but not including, 12.12.4.
Two other critical vulnerabilities, CVE-2026-112709 and CVE-2026-112710, both rated at 9.2, are particularly concerning as they enable pre-authentication remote code execution. These heap buffer overflows reside within the Active Directory authentication service, meaning attackers can exploit them without needing to log in to the affected device.
Further adding to the severity, CVE-2026-93857, also rated 9.2, affects the SIP proxy and allows for pre-authentication RCE via a stack buffer overflow. Similarly, CVE-2026-103593, with a score of 9.1, impacts the logging service and permits RCE through another stack buffer overflow.
Beyond RCE, other critical vulnerabilities include CVE-2026-93865 (CVSS 9.2), which involves missing authentication in the FireCluster synchronization daemon, enabling remote root action injection. Another critical flaw, CVE-2026-93866 (CVSS 9.2), affects the Access Portal and exploits an integer overflow, potentially leading to memory corruption and out-of-bounds writes.
WatchGuard has released patches for these vulnerabilities, with fixed versions including Fireware OS 2026.4 and 12.12.4. Specific updates for T15 and T35 devices are available as version 12.5.22. The advisory also notes that the Windows SSL VPN client credential exposure issue is resolved in version 2026.4.
While no exploitation of this specific batch of vulnerabilities has been publicly confirmed, the severity and nature of these flaws, particularly those allowing pre-authentication RCE, underscore the importance of prompt patching for organizations relying on WatchGuard firewalls to protect their networks.