WatchGuard Firebox Gets Fixes for Seven Critical Fireware OS Flaws: Update to 2026.4, 12.12.4 or 12.5.22

TL;DR: WatchGuard published fixes on October 27, 2026, for seven flaws it rates Critical in Fireware OS, the software that runs its Firebox firewalls, along with seven it rates High and three it rates lower. Several can be attacked without logging in, though each needs a particular feature turned on. If your office uses a Firebox, update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on the small T15 and T35 models). WatchGuard says it isn’t aware of any attacks using these flaws.

What happened

On October 27, 2026, WatchGuard’s Product Security Incident Response Team (PSIRT) published 18 advisories, 17 for Fireware OS and one for its Mobile VPN with SSL client. Seven of the Fireware OS flaws are rated Critical by WatchGuard, with CVSS 4.0 scores of 9.1 to 9.5:

• CVE-2026-93857 (9.2): a stack overflow in the SIP proxy that lets an attacker run code without logging in. Only Fireboxes with the SIP proxy configured are exposed.
• CVE-2026-93866 (9.2): an integer overflow in the Access Portal’s WebSocket handling that leads to a heap memory write, with no login needed. Only Fireboxes with Access Portal enabled are exposed.
• CVE-2026-93865 (9.2): the FireCluster sync service doesn’t check authentication, so a remote attacker who can reach the FireCluster management address can act without logging in. Only clustered Fireboxes are exposed.
• CVE-2026-112709 and CVE-2026-112710 (9.2 each): heap overflows in Active Directory authentication that an attacker who controls or intercepts the AD server could use. Only Fireboxes with an AD authentication server configured are exposed.
• CVE-2026-103594 (9.5): a stack overflow in WireGuard configuration handling. WatchGuard says it needs an attacker who can intercept and decrypt traffic between the Firebox and WatchGuard Cloud, and it affects FireCloud Gateway setups on 2026.2 and later and 12.12 and later.
• CVE-2026-103593 (9.1): a stack overflow in the logging service, reachable by an attacker who can impersonate or intercept the external log server. WatchGuard says it affects Fireboxes in FIPS mode with an external log server.

WatchGuard rates seven more Fireware OS flaws High, including CVE-2026-90465 (8.7): a missing authentication check in FireCluster sync that an attacker on the cluster interconnect could use. Each advisory says “WatchGuard is not aware of any exploitation of this vulnerability in the wild.”

Why it matters

A Firebox sits at the edge of the office network, so a flaw in it can give an attacker a way in to everything behind it. Firewall and VPN appliances are a common target, and attackers often study published fixes to build attacks. Small offices often set up a Firebox once and rarely update it.

What to do now

1. Check your version. The Fireware OS version shows on the Firebox dashboard and in WatchGuard Cloud. If an IT provider or WatchGuard partner looks after it, ask them.
2. Update. WatchGuard’s fixed versions are Fireware OS 2026.4 and 12.12.4. The Firebox T15 and T35 need 12.5.22. Our advice: save a configuration backup first, and plan for a short outage while the Firebox restarts.
3. Switch off features you don’t use. WatchGuard lists no workaround. Our advice: until you can update, turn off the SIP proxy, Access Portal, FireCloud Gateway and clustering if you don’t need them. Two of the flaws instead need an Active Directory authentication server, and one needs FIPS mode with an external log server; if your Firebox uses those, updating is the only fix.
4. Look for signs of trouble. Our advice: check the logs for administrator logins, settings changes or accounts you don’t recognize.

Updates

• Oct 28, 2026, 11:45 a.m. Manila: First published. WatchGuard says it isn’t aware of attacks; we’ll add a dated note if that changes.

Sources & method

Sources

• WatchGuard PSIRT advisory list
• CVE-2026-93857, CVE-2026-93865, CVE-2026-93866, CVE-2026-103593, CVE-2026-103594, CVE-2026-112709, CVE-2026-112710 and CVE-2026-90465 (WatchGuard PSIRT, Oct 27, 2026)

Method. Checked October 28, 2026, at 11:05 a.m. Manila time (03:05 UTC). The affected and fixed versions, severity ratings, CVSS 4.0 scores, required configurations and exploitation statements come from WatchGuard’s advisories. Steps labelled “our advice” are our own judgment, not WatchGuard’s. The thumbnail is the preview image from WatchGuard’s website. No affiliate links on this page. How we work.