WatchGuard Fireware critical RCE flaws: update Firebox now
WatchGuard disclosed several critical Fireware OS flaws, including pre-authentication RCE. Check affected releases, exposed features and the safe upgrade plan.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 29 October 2026
- READING TIME
- 10 min read
- TOPIC
- Vulnerabilities and CVEs
WatchGuard has published a large set of security advisories for Fireware OS, including several vulnerabilities that can permit remote code execution before authentication. The affected components include the SIP proxy, Active Directory authentication service, FireCluster synchronisation, logging and WireGuard configuration for FireCloud Gateway.
Not every vulnerability affects every deployment. Some require a particular feature such as SIP proxy, FireCluster or FireCloud Gateway. That is not a reason to wait. A firewall and VPN gateway sit at the network boundary, and an inaccurate assumption about configuration can leave a vulnerable component reachable by an attacker.
The priority action: check the model, release and enabled features of every Firebox, take a configuration backup and move to Fireware OS 2026.4, 12.12.4 or — for T15/T35 models — 12.5.22 in line with the vendor matrix. Validate services, administrator accounts and log delivery after the change.
What WatchGuard disclosed on 27 October
The vendor list contains many CVEs with different impacts. The most serious include:
| CVE | CVSS 4.0 | Component | Potential impact |
|---|---|---|---|
| CVE-2026-103594 | 9.5 | WireGuard configuration / FireCloud Gateway | denial of service or possible code execution after tampering with configuration traffic |
| CVE-2026-112710 | 9.2 | AD authentication service | pre-authentication remote code execution |
| CVE-2026-93865 | 9.2 | FireCluster synchronisation daemon | remote injection of root-level actions |
| CVE-2026-93857 | 9.2 | SIP proxy | pre-authentication remote code execution |
| CVE-2026-93866 | 9.2 | Access Portal | pre-authentication out-of-bounds write |
| CVE-2026-103593 | 9.1 | logging service | remote code execution |
This is not the complete list. WatchGuard also published High- and Medium-severity issues covering privilege escalation, root-level file modification, denial of service and local log tampering. Treat the release as an upgrade set rather than selecting one patch for the most prominent CVE.
Which Fireware OS versions are affected
For most of the critical issues, WatchGuard identifies these ranges:
- Fireware OS from 2025.1 up to but not including 2026.4;
- Fireware OS from 12.0 up to but not including 12.12.4;
- for T15 and T35 models, releases before 12.5.22.
CVE-2026-103594 has a narrower range: Fireware OS from 2026.2 up to but not including 2026.4, and from 12.12 up to but not including 12.12.4. The vendor identifies Fireware OS 2026.4 and 12.12.4 as the fixed releases.
Always compare an appliance with the specific advisory. Older, unsupported hardware or an unusual release branch may need migration rather than a routine update.
Configuration matters, but does not replace an update
CVE-2026-93857 requires a configured SIP proxy. CVE-2026-103594 affects a Firebox acting as a FireCloud Gateway, while the vendor’s described scenario requires access to tamper with TLS-decrypted traffic between the appliance and WatchGuard Cloud. Other issues involve FireCluster, AD authentication, Access Portal or system services.
An organisation that does not use a given feature may face lower direct risk. It still needs to confirm the configuration rather than rely on an administrator’s memory. A feature may have been enabled during testing, a migration, a former provider’s work or on a standby appliance.
WatchGuard says in the published advisories that it is not aware of exploitation of the described vulnerabilities in production. That describes the vendor’s current knowledge; it does not guarantee an absence of attacks. Public disclosure and available fixes typically start intensive comparison of vulnerable and patched versions.
WatchGuard Firebox upgrade plan
1. Inventory every appliance
Include production devices, clusters, standby Fireboxes, branches, labs and deployment-ready images. Record the model, release, serial number, location, owner, public addresses and enabled features.
2. Confirm exposure and features
Check SIP proxy, FireCluster, FireCloud Gateway, Access Portal, AD authentication and management interfaces. Prioritise internet-facing appliances and systems supporting multiple locations or remote employee access.
3. Prepare a safe change
Take a configuration backup, confirm that it can be restored, check the required upgrade path and schedule a window. Prepare tests for VPN, routing, policies, authentication, clustering, VoIP and logging. For a cluster, plan node order and confirm synchronisation health.
4. Upgrade to the vendor release
The target branch depends on the model and current release. Do not assume that downloading an image automatically activates it. Confirm the running software version on every appliance after the restart.
5. Review evidence and monitoring
Look for new administrator accounts, unusual sign-ins, policy, VPN and route changes, unexpected restarts and unexplained outbound connections. Confirm that the Firebox still sends complete logs to an external system, particularly because one of the disclosed vulnerabilities affects the logging service.
If an immediate upgrade is impossible
Restrict management interfaces to trusted addresses and a dedicated administration network, disable unused proxies and portals, and require a controlled operator path with MFA. Increase monitoring for configuration changes and connections. These are temporary controls. They do not remove vulnerable code and should not replace the update.
If no supported release exists for an appliance, prepare a replacement. An unpatchable firewall becomes a permanent exception at the network boundary — exactly where the business needs the highest predictability.
Source facts and Breachroad conclusions
WatchGuard confirms the CVE identifiers, scores, required configurations, affected version ranges and fixed releases. Its individual advisories also state that the vendor is not aware of exploitation.
Upgrade order based on exposure, the log-review scope and the evidence set after the change are Breachroad recommendations. Administrators and service owners can practise these decisions through cybersecurity training for businesses. If the organisation lacks a complete appliance list or exposure map, begin with an IT security audit.
WatchGuard Fireware vulnerability FAQ
Is every Firebox affected by every vulnerability?
No. Impact depends on the version, model and enabled features. CVE-2026-93857 requires SIP proxy, while CVE-2026-103594 applies to FireCloud Gateway.
Which Fireware OS version should an organisation install?
WatchGuard identifies Fireware OS 2026.4, 12.12.4 or 12.5.22 for T15/T35 models. Confirm the exact upgrade path for the appliance model and current branch.
Are these vulnerabilities under active exploitation?
WatchGuard says it is not aware of exploitation. That does not remove the need to update because several issues allow code execution before authentication.
Is disabling SIP proxy enough?
It reduces exposure to CVE-2026-93857 but does not address other Fireware OS vulnerabilities. Installing a fixed release remains the correct solution.
Primary sources: WatchGuard PSIRT advisory list, WatchGuard CVE-2026-93857 advisory, WatchGuard CVE-2026-103594 advisory.
