FireCluster root action invocation
A cluster-interconnect attacker, including a compromised peer or on-path attacker, can invoke privileged management actions on a FireCluster member.
WatchGuard fixes 17 Fireware flaws across cluster, management, AD and proxy boundaries
WatchGuard’s October 27 Fireware batch includes cluster root-action injection, SIP proxy RCE, AD-response overflows and configuration leaks. Preconditions differ; the vendor reports no known exploitation. Update to the model-appropriate fixed release.
- Disclosed
- Oct 27, 2026
- Public disclosure date
- Severity
- Sharted
- 17 CVEs tracked here
- Splash zone
- Fireware deployments with affected management, FireCluster, SIP/Access Portal, AD or other configured features; prerequisites vary
- watchguard
- In the wild
- Not seen
- WatchGuard reports no known in-the-wild exploitation for these 17 advisories.
What happened
L3 reflects multiple security-boundary failures in mainstream edge appliances. This is not a universal unauthenticated Internet-to-root chain: AD, cluster interconnect, FIPS logging, local access and cloud interception are distinct prerequisites. The SSH configuration-read, SIP proxy and enabled FireCluster management-IP issues deserve their own exposure checks. No victim count is established. The same date’s Mobile VPN Windows-client issue is a different product and is not included in this 17-flaw count.
What’s in the bowl
FireCluster sync denial of service
An attacker on the cluster interconnect can repeatedly crash synchronization on a FireCluster deployment.
Diagnostic command file overwrite
An authenticated Device Monitor or higher role with CLI access can write numeric content to arbitrary paths or kernel parameters as root.
AD response heap overflow, second flaw
Requires AD authentication configuration and control/interception of configured AD-server traffic; a crafted response can crash the service or execute code.
AD response heap overflow
Requires AD authentication configuration and control/interception of configured AD-server traffic; a crafted response can crash the service or execute code.
SSH authentication XPath injection
An unauthenticated caller reaching management SSH can extract configuration secrets.
Mobile VPN enforcement overflow
An authenticated Mobile VPN user can crash or execute code as an unprivileged process when Network Access Control is enabled.
Certificate management overflow
An authenticated attacker with management-interface access can crash certd and potentially execute code.
AuthPoint MFA session hijack
Requires local appliance access, AuthPoint integration and persuading a victim to accept an MFA push; not an unauthenticated Internet MFA bypass.
FireCloud Gateway configuration overflow
Requires a FireCloud Gateway and TLS-decrypted man-in-the-middle access between it and WatchGuard Cloud; altered WireGuard configuration may cause DoS or code execution.
FireCluster BOVPN tunnel termination
An attacker on the cluster synchronization segment can prematurely terminate tunnels when FireCluster and at least one BOVPN tunnel are configured.
FireCluster management-IP root action injection
An unauthenticated network caller reaching the FireCluster management IP can invoke privileged administrative actions when clustering is enabled.
Logging certificate stack overflow
Requires FIPS mode, an external log server and an adjacent attacker able to impersonate/intercept that server; a crafted certificate can execute code as root.
SIP proxy pre-authentication overflow
An unauthenticated request through a policy using the configured SIP proxy can execute code.
Management login denial of service
An unauthenticated caller reaching management can repeatedly crash its service and interrupt administrator sessions; traffic processing is unaffected.
Access Portal integer overflow
An unauthenticated caller can cause a heap out-of-bounds write through WebSocket handling when Access Portal is enabled.
Local firewall-daemon file overwrite
A local low-privilege process can plant a filesystem object and trigger a list update to overwrite files as root; content is partly constrained.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Fireware newer release family | 2026.4 | |
| Fireware 12.x standard platforms | 12.12.4 | |
| Fireware T15/T35 | 12.5.22 |
Crime-scene timeline
Oct 27, 2026
WatchGuard publishes the 17 Fireware advisories
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- WatchGuard CVE-2026-90465PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93862PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-90464PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-112710PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-112709PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93434PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-113881PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-90442PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-82332PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-103594PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-104381PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93865PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-103593PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93857PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-111107PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93866PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.
- WatchGuard CVE-2026-93864PrimaryFeature prerequisites, affected platforms, solution and no-known-exploitation statement.