WatchGuard published 18 security advisories for Fireware OS, the software that runs its Firebox firewall appliances, and seven of them score 9.1 or higher on CVSS 4.0. The company released the advisories and fixes on October 27.
Severity Breakdown Across the 18 Advisories
Seven advisories carry critical scores of 9.1 or above, seven are rated high and four are medium. WatchGuard’s own AI security research team found most of the flaws. No exploitation has been confirmed.
The Highest-Rated Flaw in WireGuard Configuration
CVE-2026-103594 scores 9.5 and is the worst of the set. It is a stack buffer overflow in the WireGuard configuration that allows remote code execution.
Pre-Authentication Bugs Scored at 9.2
Several others score 9.2. CVE-2026-93866 is a pre-authentication integer overflow in the Access Portal. CVE-2026-93857 is a pre-authentication stack overflow in the SIP proxy. CVE-2026-112709 and CVE-2026-112710 are heap overflows in the Active Directory authentication service that allow pre-authentication remote code execution.
Missing Authentication in the FireCluster Sync Daemon
CVE-2026-93865, also scored 9.2, is a missing-authentication flaw in the FireCluster synchronization daemon. It permits remote injection of root-level actions. The flaw affects the component that coordinates clustered Firebox units, which means an attacker reaching it could act with root privileges on the appliance.
Fixed Releases in Three Fireware OS Lines
WatchGuard released fixes in Fireware OS 2026.4, 12.12.4 and 12.5.22. The three lines cover the active branches of the operating system, and each advisory maps to a patched version in one or more of them.
Why Edge Appliance Flaws Carry Added Weight
Firewalls sit at the network perimeter and often terminate VPN connections, authenticate users and proxy traffic. The impact assessment for this release says appliances at the network edge are exposed to unauthenticated code execution under some configurations.
The component list in the advisories reflects that role. WireGuard configuration, the Access Portal, the SIP proxy and the Active Directory authentication service are all features that are exposed to external or semi-trusted traffic when enabled. The word “configurations” matters: not every flaw reaches every deployment, and exposure depends on which features an administrator has turned on.
AI-Assisted Research by the Vendor’s Own Team
WatchGuard credits its own AI security research team with finding most of the vulnerabilities. That means the vendor identified the majority of the flaws internally before any outside exploitation was reported. The result is a large batch of critical findings disclosed at once, together with fixes, instead of a stream of individual reports.
What Is and Is Not Known
The advisories do not report any attacks in the wild. The flaws are identified by CVE number, and their technical categories are public, which gives anyone studying the patches a starting point for analysis.
Remote code execution without authentication on a firewall is among the most serious outcomes for a perimeter device, which explains the concentration of scores between 9.2 and 9.5. Administrators running affected Fireware OS versions face a set of fixes spread across three version lines, and the choice of upgrade path depends on which line a given appliance follows.
The size of the release, 18 advisories on a single day, is notable on its own. Whether researchers or attackers publish exploit code for the heap and stack overflows will determine how quickly the risk moves from theoretical to active.
The severity distribution is itself informative. Seven critical, seven high and four medium advisories mean that more than a third of the release is rated 9.1 or above. The flaws span several unrelated components, from VPN configuration to authentication services, rather than clustering in one module. WatchGuard has not reported any customer incidents linked to these issues, and the advisories were published together with the fixes.
