WatchGuard published 17 Fireware OS security advisories on 27 October 2026, seven of them with CVSS 4.0 scores of 9.0 or higher in WatchGuard's CVE records. CVE-2026-93857 (9.2): a stack-based buffer overflow in Fireware OS's SIP proxy lets a remote, unauthenticated attacker execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. CVE-2026-93866 (9.2): an integer overflow in the WebSocket connection handling used by the Access Portal lets a remote, unauthenticated attacker write beyond the bounds of a heap buffer while the Access Portal feature is enabled.

CVE-2026-93865 (9.2): missing authentication in the FireCluster synchronization daemon lets a remote, unauthenticated attacker invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when clustering is enabled. CVE-2026-112709 and CVE-2026-112710 (9.2 each): heap-based buffer overflows in the authentication service let an attacker who controls or intercepts traffic to the configured Active Directory server cause a denial of service and potentially execute arbitrary code.

CVE-2026-103594 (9.5): a stack-based buffer overflow in WireGuard configuration processing on Fireboxes configured as a FireCloud Gateway, exploitable by an attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud. CVE-2026-103593 (9.1): a stack-based buffer overflow in the logging service on Fireboxes in FIPS mode with an external log server, exploitable by an attacker who can impersonate or intercept traffic to the log server.

For each of these seven, WatchGuard says it is not aware of any exploitation in the wild. The same day WatchGuard also published a Mobile VPN with SSL Client for Windows advisory (CVE-2026-115495, 5.7). (source: WatchGuard PSIRT)