FHN 
WatchGuard has reported seven critical security flaws in Fireware OS, the operating system used by its Firebox firewalls. Disclosed on October 27, 2026, these vulnerabilities could allow attackers to run malicious code remotely, gain high-level access, or damage system memory.
The security update covers 18 vulnerabilities across Fireware OS and the Windows Mobile VPN with SSL client. The seven critical flaws have CVSS scores between 9.1 and 9.5, making them a serious concern for organizations using affected devices.
Seven Critical Flaws Found in Firebox Firewalls
The vulnerabilities affect several firewall services, including WireGuard, Active Directory authentication, SIP proxy, FireCluster, Access Portal, and logging.
The most severe issue, CVE-2026-103594, has a CVSS score of 9.5. It involves a buffer overflow in WireGuard configuration that could allow remote code execution.
Two other flaws, CVE-2026-112709 and CVE-2026-112710, have scores of 9.2. Both affect the Active Directory authentication service and could allow attackers to execute code remotely without logging in first.
Other vulnerabilities affect FireCluster synchronization, SIP proxy, Access Portal, and the logging service. Depending on the flaw, attackers could execute code, gain elevated privileges, or cause memory corruption.
Affected Versions and Security Fixes
Some affected Fireware OS versions include releases in the 2026.2 and 12.12 series. According to the supplied advisory details, versions 2026.4 and 12.12.4 address most of the listed issues. Certain T15 and T35 devices may require version 12.5.22.
Administrators should check WatchGuard’s official security advisories to confirm which updates apply to their specific devices before upgrading.
Recommended Security Measures
Organizations using WatchGuard Firebox firewalls should identify affected devices and install the appropriate security updates. They should also review exposed services, monitor firewall logs for unusual activity, and investigate unexpected configuration changes or service crashes.
After updating, security teams should verify the installed firmware version and confirm that all required fixes have been applied.
Note: The vulnerability details and affected versions above are based on the supplied information and should be verified against WatchGuard’s official advisories before publication. The information provided does not confirm that these newly reported flaws have been exploited in real-world attacks.
About the Author
