WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks

WatchGuard disclosed seven critical Fireware OS vulnerabilities in an October 27, 2026 advisory, affecting Firebox firewalls and potentially enabling remote code execution, root-level action injection, and memory corruption.

They are part of a wider release that covers 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client. The seven critical entries carry severity scores between 9.1 and 9.5.

Other issues in the release could expose configuration secrets, allow file changes with root rights, hijack sessions, or disrupt firewall services. Risks vary by service, software version, and the access an attacker needs.

The highest-rated issue, CVE-2026-103594, scores 9.5 and involves a stack buffer overflow in WireGuard configuration that allows remote code execution. Its affected ranges cover Fireware OS 2026.2 through versions before 2026.4, and 12.12 through versions before 12.12.4.

Two further flaws, CVE-2026-112709 and CVE-2026-112710, each score 9.2. Both involve heap buffer overflows in the Active Directory authentication service and allow remote code execution before authentication.

WatchGuard Discloses Critical Firewall Flaws

WatchGuard’s indexed advisory confirms that description for CVE-2026-112710. These bugs are notable because attackers do not need to complete a login before triggering the vulnerable code.

CVE-2026-93857, also rated 9.2, affects the SIP proxy and allows remote code execution before authentication through a stack buffer overflow. CVE-2026-103593 scores 9.1 and affects the logging service, where another stack buffer overflow can allow remote code execution.

The remaining critical issues affect FireCluster synchronization and Access Portal. CVE-2026-93865 scores 9.2 and involves missing authentication in the FireCluster sync daemon, allowing remote root action injection.

Critical Flaws :

CVE-2026-93866 carries the same score and involves an integer overflow before authentication in Access Portal that allows an out-of-bounds write. That description establishes memory corruption, not confirmed code execution.

Two lower-scored entries also involve root-level access. CVE-2026-90464 lets an authenticated attacker modify arbitrary files as root because it lacks command validation. CVE-2026-93864 allows a local attacker to overwrite arbitrary files as root through a link-following flaw in firewalld.

Earlier reporting on WatchGuard Firebox OS vulnerabilities covered separate authenticated code execution and file-write issues. Do not confuse those earlier flaws with this release.

For most listed Fireware OS issues, the supplied advisory data identifies 2026.4 and 12.12.4 as fixed versions. Where applicable, T15 and T35 devices require 12.5.22. The Windows SSL VPN client credential-exposure issue is fixed in 2026.4.

Previous coverage of an exploited WatchGuard zero-day concerns CVE-2025-14733, not these newly listed flaws. It does not establish exploitation of this release.

We could not retrieve full advisory pages during verification. Apart from the indexed confirmation noted above, the October disclosure details and patch versions therefore remain based on the supplied list and need confirmation before publication.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks appeared first on Cyber Security News.