WatchGuard published 18 security advisories for its Firebox platform on 27 October 2026: 17 for Fireware OS and one for the Mobile VPN with SSL client on Windows. Seven of the Fireware flaws score 9.1 or higher on CVSS 4.0.
What happened
Three critical bugs are reachable without credentials when the matching feature is enabled. A pre-authentication stack buffer overflow in the SIP proxy (CVE-2026-93857, 9.2) lets a remote attacker run code through any policy that uses the SIP proxy. A pre-authentication integer overflow in Access Portal WebSocket handling (CVE-2026-93866, 9.2) writes past a heap buffer while Access Portal is on. Missing authentication in the FireCluster sync daemon (CVE-2026-93865, 9.2) lets an attacker invoke privileged system actions through the cluster management address.
The top score, 9.5, goes to CVE-2026-103594: a stack buffer overflow in WireGuard configuration processing that needs a man-in-the-middle position between the Firebox and WatchGuard Cloud. Two heap overflows in the Active Directory authentication service (CVE-2026-112709 and CVE-2026-112710, both 9.2) need control of, or a position on, traffic to the configured AD server. A stack overflow in the logging service (CVE-2026-103593, 9.1) is triggered by a crafted certificate from an impersonated log server and ends in root.
Lower down the list, an XPath injection in SSH authentication (CVE-2026-93434, 8.7) lets secrets be pulled out of the configuration, and an AuthPoint MFA verification flaw (CVE-2026-82332, 5.6) allows session hijacking. WatchGuard says it is not aware of exploitation in the wild for any of the 18 issues.
Who is affected
- Fireware OS 2025.1 up to, but not including, 2026.4
- Fireware OS 12.0 up to 12.12.4 on the 12.x branch
- Firebox T15 and T35 models running 12.0 up to 12.5.22
- Mobile VPN with SSL client for Windows older than 2026.4
What to do now
Upgrade every Firebox to Fireware OS 2026.4 or 12.12.4, or 12.5.22 on T15 and T35, and move the Mobile VPN with SSL client to 2026.4.
- Patch internet-facing fireboxes first; Access Portal and VPN endpoints are the exposed surface.
- If a patch has to wait, restrict management access to trusted hosts and disable Access Portal or the SIP proxy on policies that do not need them.
- Keep FireCluster sync traffic on a dedicated segment, not a shared management VLAN.
- Review logs for configuration reads over SSH and for cluster sync requests from outside your management range.
What this means for South African businesses
Firebox appliances are common in South African branch offices and in MSP-managed stacks, and Access Portal or SSL VPN is usually published to the internet so staff can work remotely. The flaws that need a network position matter less; the three unauthenticated ones matter a great deal, because all they require is a feature many sites leave switched on. My read is that a single-firewall client with no change window will sit exposed for weeks, which is exactly the window opportunistic scanning exploits.
Source: WatchGuard Security Advisories.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.