# WatchGuard Fireware OS: 7 Critical Vulnerabilities Allowing Remote Code Execution (CVE-2026-103594, CVE-2026-112710, CVE-2026-112709, CVE-2026-93865, CVE-2026-93857, CVE-2026-93866, CVE-2026-103593)

> On 2026-10-27 WatchGuard published advisories for seven critical Fireware OS flaws (memory corruption in the WireGuard configuration handler, Active Directory authentication service, SIP proxy, Access Portal and logging service, plus missing authentication in the FireCluster sync daemon) rated CVSS 9.1-9.5 by the press and 9.5/9.2 in NVD CVSS v4.0 for six of them. Fixes ship in Fireware OS 2026.4 and 12.12.4 (12.5.22 for T15/T35); WatchGuard reports no known exploitation.

- **Published:** 2026-10-29T03:20:22Z
- **Last reviewed:** 2026-10-29T03:20:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4699
- **ID:** TL-2026-4699
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-103594, CVE-2026-112710, CVE-2026-112709, CVE-2026-93865, CVE-2026-93857, CVE-2026-93866, CVE-2026-103593

## Description

WatchGuard PSIRT published a batch of 18 Fireware OS security issues on 2026-10-27, seven of which are rated critical. All seven are memory-safety or authentication flaws in network-facing or network-adjacent Firebox services, and several are described as leading to arbitrary code execution as root.

Per-CVE detail from NVD/WatchGuard PSIRT: CVE-2026-103594 (CVSS v4.0 9.5) is a stack-based buffer overflow (CWE-121/787/1284) in WireGuard configuration processing; an attacker with man-in-the-middle, TLS-decrypted access between a Firebox configured as a FireCloud Gateway and WatchGuard Cloud can tamper with the FireCloud Gateway configuration payload to cause denial of service or potentially execute code. CVE-2026-112710 and CVE-2026-112709 (9.2) are heap-based buffer overflows (CWE-122/131, 787 for the latter) in the Fireware authentication service, triggered by a crafted response from, or by interception of traffic to, the configured Active Directory server. CVE-2026-93865 (9.2) is missing authentication/authorization (CWE-306/862/77) in the FireCluster synchronization daemon, allowing a remote unauthenticated attacker to invoke privileged system-level administrative actions. CVE-2026-93857 (9.2) is a stack-based buffer overflow (CWE-120/121/787) in the SIP proxy, reachable unauthenticated by sending a crafted request through a policy that uses the SIP proxy. CVE-2026-93866 (9.2) is an integer overflow (CWE-190/787, also tagged CWE-288) in the WebSocket handling of the Access Portal that yields a heap out-of-bounds write for a remote unauthenticated attacker while the Access Portal is enabled. CVE-2026-103593 is a stack-based buffer overflow (CWE-121/787) in the logging service, exploitable by a network-adjacent attacker who can impersonate or intercept traffic to the configured log server and present a crafted certificate, resulting in code execution as root.

Source discrepancies to note: the Cyber Security News article describes the critical set as 9.1-9.5 and labels most as pre-authentication RCE with no prerequisites, whereas NVD records show several require a man-in-the-middle or log/AD-server impersonation position (attack requirements AT:P), and the NVD CVSS v4.0 record for CVE-2026-103593 shows 7.1 HIGH (AV:L) rather than 9.1. The 9.1 figure is therefore the press-reported score. Affected ranges also differ by CVE: CVE-2026-103594 affects 2026.2 up to but excluding 2026.4 and 12.12 up to but excluding 12.12.4, while the other six list 2025.1 to before 2026.4, 12.0 to before 12.12.4, and 12.0 to before 12.5.22 on T15/T35. WatchGuard documents no workarounds for CVE-2026-103594.

The same release fixes additional issues including CVE-2026-90464 (authenticated arbitrary file modification as root), CVE-2026-93864 (local root file overwrite via link following in firewalld), CVE-2026-90465 (FireCluster sync missing authentication, 8.7), CVE-2026-93862, CVE-2026-93434 (XPath injection in SSH authentication, 8.7), CVE-2026-113881, and a credential exposure in the Windows SSL VPN client fixed in 2026.4. No active exploitation, public PoC, IOCs or attribution have been reported for this release; this is distinct from the earlier exploited WatchGuard zero-day CVE-2025-14733.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1059 Command and Scripting Interpreter

## Sources

- [WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks](https://cybersecuritynews.com/watchguard-discloses-critical-firewall-flaws/)
- [WatchGuard PSIRT Advisories](https://psirt.watchguard.com/)
- [WatchGuard PSIRT: CVE-2026-103594 (WireGuard configuration stack overflow)](https://psirt.watchguard.com/CVE-2026-103594)
- [WatchGuard PSIRT: CVE-2026-93865 (FireCluster missing authentication)](https://psirt.watchguard.com/CVE-2026-93865)
- [WatchGuard PSIRT: CVE-2026-112710 (AD authentication heap overflow)](https://psirt.watchguard.com/CVE-2026-112710)
- [WatchGuard PSIRT: CVE-2026-112709 (AD authentication heap overflow)](https://psirt.watchguard.com/CVE-2026-112709)
- [WatchGuard PSIRT: CVE-2026-93857 (SIP proxy stack overflow)](https://psirt.watchguard.com/CVE-2026-93857)
- [WatchGuard PSIRT: CVE-2026-93866 (Access Portal integer overflow)](https://psirt.watchguard.com/CVE-2026-93866)
- [WatchGuard PSIRT: CVE-2026-103593 (logging service stack overflow)](https://psirt.watchguard.com/CVE-2026-103593)
- [NVD: CVE-2026-103594](https://nvd.nist.gov/vuln/detail/CVE-2026-103594)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4699