WatchGuard has published 18 security advisories for its Firebox firewall platform, fixing a large batch of vulnerabilities in Fireware OS that administrators should patch without delay. Seven of the flaws are rated critical, seven high and four medium, according to a roundup of the 27 October 2026 release, and the worst single issue, tracked as CVE-2026-103594, scores 9.5 on the CVSS version 4 scale and could allow code execution. Several of the critical bugs can let unauthenticated attackers run code or take administrative actions under certain conditions, which is a serious exposure for devices that sit at the edge of a network.

Fixes available across three branches

The fixes are delivered in Fireware OS 2026.4, 12.12.4 and 12.5.22, depending on the appliance and branch in use, and WatchGuard's own support pages list the 27 October releases as resolving security issues. WatchGuard's own artificial intelligence security research team found most of the flaws, according to the roundup, which suggests the batch came largely from internal testing rather than from reports of attacks. Administrators should check which branch each appliance runs and move it to the matching fixed release.

No exploitation confirmed so far

No active exploitation of these flaws has been confirmed in the sources checked, and the roundup records the actively exploited count as none. That distinction matters: this is a patch-now warning, not a report of ongoing attacks, and it is separate from WatchGuard's September batch of 15 Fireware flaws. Still, firewalls are high-value targets precisely because they guard everything behind them, so leaving known critical flaws unpatched invites exactly the kind of attention owners least want.

Sources: SecurityOnline, WatchGuard Support Center.