WatchGuard has disclosed seven critical vulnerabilities in Fireware OS, the operating system running its Firebox firewalls, in an advisory dated 27 October 2026. The flaws form part of a wider release covering 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client. Severity scores for the seven critical entries range from 9.1 to 9.5.

The most severe flaws

The highest-rated flaw, CVE-2026-103594, scores 9.5 and is a stack buffer overflow in WireGuard configuration handling that could allow remote code execution. Two heap buffer overflows in the Active Directory authentication service, CVE-2026-112709 and CVE-2026-112710, each score 9.2 and could also allow remote code execution before authentication, meaning attackers would not need to log in first.

Fix versions and interim steps

The remaining critical entries affect the SIP proxy, the logging service, FireCluster synchronisation and the Access Portal. CVE-2026-93857, rated 9.2, is a stack buffer overflow in the SIP proxy that could allow remote code execution before authentication. CVE-2026-93865, also rated 9.2, is a missing-authentication flaw in the FireCluster sync daemon that could allow remote root action injection, while CVE-2026-93866 is an integer overflow in Access Portal handling.

WatchGuard reports no known exploitation of these flaws, and none of them appears in CISA's Known Exploited Vulnerabilities catalogue, so this is a patch-now warning rather than evidence of attacks in progress. Administrators should upgrade to Fireware OS 2026.4 or 12.12.4, depending on their branch, with T15 and T35 devices requiring 12.5.22, and update the Windows SSL VPN client. Until patched, management interfaces should be limited to trusted hosts and unneeded features such as Access Portal or the SIP proxy disabled.

Sources: Cyber Security News, SecurityOnline.