Threat reportVulnerabilityTL-2026-4699
WatchGuard Fireware OS: 7 Critical Vulnerabilities Allowing Remote Code Execution (CVE-2026-103594, CVE-2026-112710, CVE-2026-112709, CVE-2026-93865, CVE-2026-93857, CVE-2026-93866, CVE-2026-103593)
WatchGuard Fireware OS (TL-2026-4699) is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-10-29. It has no confirmed attribution, affects WatchGuard Fireware OS (Firebox), references 7 CVEs (CVE-2026-103594, CVE-2026-112710, CVE-2026-112709), maps to 3 MITRE ATT&CK techniques (T1059, T1190, T1557), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4699
- Threat ID
- TL-2026-4699
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, manufacturing, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in WatchGuard Fireware OS
Malware and tooling: WatchGuard Windows SSL VPN Client
How WatchGuard Fireware OS works
On 2026-10-27 WatchGuard published advisories for seven critical Fireware OS flaws (memory corruption in the WireGuard configuration handler, Active Directory authentication service, SIP proxy, Access Portal and logging service, plus missing authentication in the FireCluster sync daemon) rated CVSS 9.1-9.5 by the press and 9.5/9.2 in NVD CVSS v4.0 for six of them. Fixes ship in Fireware OS 2026.4 and 12.12.4 (12.5.22 for T15/T35); WatchGuard reports no known exploitation.
WatchGuard PSIRT published a batch of 18 Fireware OS security issues on 2026-10-27, seven of which are rated critical. All seven are memory-safety or authentication flaws in network-facing or network-adjacent Firebox services, and several are described as leading to arbitrary code execution as root.
Per-CVE detail from NVD/WatchGuard PSIRT: CVE-2026-103594 (CVSS v4.0 9.5) is a stack-based buffer overflow (CWE-121/787/1284) in WireGuard configuration processing; an attacker with man-in-the-middle, TLS-decrypted access between a Firebox configured as a FireCloud Gateway and WatchGuard Cloud can tamper with the FireCloud Gateway configuration payload to cause denial of service or potentially execute code. CVE-2026-112710 and CVE-2026-112709 (9.2) are heap-based buffer overflows (CWE-122/131, 787 for the latter) in the Fireware authentication service, triggered by a crafted response from, or by interception of traffic to, the configured Active Directory server. CVE-2026-93865 (9.2) is missing authentication/authorization (CWE-306/862/77) in the FireCluster synchronization daemon, allowing a remote unauthenticated attacker to invoke privileged system-level administrative actions. CVE-2026-93857 (9.2) is a stack-based buffer overflow (CWE-120/121/787) in the SIP proxy, reachable unauthenticated by sending a crafted request through a policy that uses the SIP proxy. CVE-2026-93866 (9.2) is an integer overflow (CWE-190/787, also tagged CWE-288) in the WebSocket handling of the Access Portal that yields a heap out-of-bounds write for a remote unauthenticated attacker while the Access Portal is enabled. CVE-2026-103593 is a stack-based buffer overflow (CWE-121/787) in the logging service, exploitable by a network-adjacent attacker who can impersonate or intercept traffic to the configured log server and present a crafted certificate, resulting in code execution as root.
Source discrepancies to note: the Cyber Security News article describes the critical set as 9.1-9.5 and labels most as pre-authentication RCE with no prerequisites, whereas NVD records show several require a man-in-the-middle or log/AD-server impersonation position (attack requirements AT:P), and the NVD CVSS v4.0 record for CVE-2026-103593 shows 7.1 HIGH (AV:L) rather than 9.1. The 9.1 figure is therefore the press-reported score. Affected ranges also differ by CVE: CVE-2026-103594 affects 2026.2 up to but excluding 2026.4 and 12.12 up to but excluding 12.12.4, while the other six list 2025.1 to before 2026.4, 12.0 to before 12.12.4, and 12.0 to before 12.5.22 on T15/T35. WatchGuard documents no workarounds for CVE-2026-103594.
The same release fixes additional issues including CVE-2026-90464 (authenticated arbitrary file modification as root), CVE-2026-93864 (local root file overwrite via link following in firewalld), CVE-2026-90465 (FireCluster sync missing authentication, 8.7), CVE-2026-93862, CVE-2026-93434 (XPath injection in SSH authentication, 8.7), CVE-2026-113881, and a credential exposure in the Windows SSL VPN client fixed in 2026.4. No active exploitation, public PoC, IOCs or attribution have been reported for this release; this is distinct from the earlier exploited WatchGuard zero-day CVE-2025-14733.
MITRE ATT&CK techniques used in TL-2026-4699
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Collection
Affected products and versions in WatchGuard Fireware OS
- WatchGuard — Fireware OS (Firebox)
Vulnerable versions: 2026.2 to before 2026.4 (CVE-2026-103594); 12.12 to before 12.12.4 (CVE-2026-103594); 2025.1 to before 2026.4 (other six CVEs, default platforms); 12.0 to before 12.12.4 (other six CVEs, default platforms); 12.0 to before 12.5.22 (T15/T35)
Fixed in: 2026.4; 12.12.4; 12.5.22 (T15/T35) - WatchGuard — Windows SSL VPN Client
Vulnerable versions: versions before 2026.4 (credential exposure)
Fixed in: 2026.4
Remediation for WatchGuard Fireware OS
Patches
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35 platforms)
- Windows SSL VPN client 2026.4
Immediate actions
- Upgrade Firebox appliances to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15/T35)
- Upgrade the WatchGuard Windows SSL VPN client to 2026.4
- Prioritize Fireboxes that expose the Access Portal, use SIP proxy policies, use Active Directory authentication, run FireCluster, or act as FireCloud Gateway
Workarounds
- None documented by WatchGuard for CVE-2026-103594; disable unused features (Access Portal, SIP proxy) where operationally possible until patched
Longer-term hardening
- Restrict management and cluster-sync interfaces to trusted networks
- Ensure the paths from the Firebox to Active Directory servers and log servers are on trusted, authenticated links
- Monitor WatchGuard PSIRT for exploitation updates and subscribe to advisories
CVEs associated with WatchGuard Fireware OS
CVE-2026-103594, CVE-2026-112710, CVE-2026-112709, CVE-2026-93865, CVE-2026-93857, CVE-2026-93866, CVE-2026-103593
Weaknesses (CWE) in WatchGuard Fireware OS
CWE-121, CWE-122, CWE-120, CWE-131, CWE-190, CWE-288, CWE-306, CWE-77, CWE-787, CWE-862
Timeline of WatchGuard Fireware OS
- Context: WatchGuard released earlier Fireware OS branches fixing 11 separate flaws (including iked critical issues); a distinct release from this one
- WatchGuard publishes a separate WatchGuard Agent advisory (CVE-2026-115253, CVSS 7.3, incorrect permissions on log directory allowing local tampering), five days before the Fireware batch
- NVD records for CVE-2026-103594, -112710, -112709, -93865, -93857, -93866 and -103593 published with CVSS v4.0 scores
- Fireware OS 2026.4 and 12.12.4 (12.5.22 for T15/T35) listed as fixed releases; Windows SSL VPN client 2026.4 fixes credential exposure
- WatchGuard PSIRT publishes advisories for 18 Fireware OS issues, seven rated critical
- WatchGuard publishes Mobile VPN with SSL advisory CVE-2026-115495 (CVSS 5.7, cleartext transmission of VPN credentials over a local management socket) alongside the Fireware advisories
- Cyber Security News reports the seven critical flaws; no active exploitation reported
Sources cited for WatchGuard Fireware OS
- WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks
- WatchGuard PSIRT Advisories
- WatchGuard PSIRT: CVE-2026-103594 (WireGuard configuration stack overflow)
- WatchGuard PSIRT: CVE-2026-93865 (FireCluster missing authentication)
- WatchGuard PSIRT: CVE-2026-112710 (AD authentication heap overflow)
- WatchGuard PSIRT: CVE-2026-112709 (AD authentication heap overflow)
- WatchGuard PSIRT: CVE-2026-93857 (SIP proxy stack overflow)
- WatchGuard PSIRT: CVE-2026-93866 (Access Portal integer overflow)
- WatchGuard PSIRT: CVE-2026-103593 (logging service stack overflow)
- NVD: CVE-2026-103594
Detection coverage for TL-2026-4699
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4699 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.