WatchGuard Discloses 7 Critical Firewall Flaws Allowing Remote Code Execution and Root-Level Attacks

What happened?

WatchGuard disclosed seven critical Fireware OS vulnerabilities in an October 27, 2026 advisory, affecting Firebox firewalls and potentially enabling remote code execution, root-level action injection, and memory corruption. They are part of a wider release that covers 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client. The seven critical entries carry severity scores between 9.1 and 9.5. Other issues in the release could expose configuration secrets, allow file changes with root rights, hijack sessions, or disrupt firewall services.

Key details

• CVE-2026-103594 scores 9.5 and involves a stack buffer overflow in WireGuard configuration allowing remote code execution.
• CVE-2026-112710 scores 9.2 and involves a heap buffer overflow in the Active Directory authentication service allowing remote code execution before authentication.
• CVE-2026-112709 scores 9.2 and involves a heap buffer overflow in the Active Directory authentication service allowing remote code execution before authentication.
• CVE-2026-93857 scores 9.2 and involves a stack buffer overflow in the SIP proxy allowing remote code execution before authentication.
• CVE-2026-93865 scores 9.2 and involves missing authentication in the FireCluster sync daemon allowing remote root action injection.
• CVE-2026-93866 scores 9.2 and involves an integer overflow before authentication in Access Portal allowing out-of-bounds write.
• CVE-2026-103593 scores 9.1 and involves a stack buffer overflow in the logging service allowing remote code execution.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.