WatchGuard has published a sweeping security advisory covering 18 vulnerabilities across its Fireware OS and the Windows Mobile VPN with SSL client, with seven of those flaws rated critical and carrying CVSS scores between 9.1 and 9.5. The October 27, 2026 disclosure touches Firebox firewalls broadly, and several of the most severe bugs can be triggered by an attacker who hasn’t logged in at all.

The Headline Bug: A WireGuard Buffer Overflow

The single highest-rated issue, CVE-2026-103594, scores 9.5 on the CVSS scale and stems from a stack buffer overflow in how Fireware OS handles WireGuard VPN configuration, opening the door to remote code execution. The flaw affects Fireware OS versions 2026.2 up to (but not including) 2026.4, as well as the 12.12 branch prior to 12.12.4 — a wide enough range that most currently deployed Fireboxes using WireGuard are likely exposed until patched.

Pre-Authentication Flaws in Active Directory and SIP Handling

Two additional critical bugs, CVE-2026-112709 and CVE-2026-112710, each carry a 9.2 score and involve heap buffer overflows in the firewall’s Active Directory authentication service. WatchGuard’s own advisory confirms that at least CVE-2026-112710 can be exploited for remote code execution before a user ever authenticates — meaning an attacker with network access to the service doesn’t need valid credentials to attempt exploitation. A related pre-authentication bug, CVE-2026-93857, also scored 9.2, affects the SIP proxy through a separate stack buffer overflow with the same remote code execution outcome. Rounding out the logging side, CVE-2026-103593 (9.1) is a stack buffer overflow in the firewall’s logging service that can likewise lead to code execution.

Root-Level Risk From Clustering and Access Portal Bugs

Two more critical entries involve root-level exposure through different mechanisms. CVE-2026-93865, scored 9.2, is a missing-authentication flaw in the FireCluster synchronization daemon that WatchGuard says allows remote injection of root-level actions — a serious concern for any organization running Fireboxes in a clustered, high-availability configuration. CVE-2026-93866, also 9.2, is an integer overflow in the pre-authentication Access Portal that leads to an out-of-bounds memory write; WatchGuard’s advisory describes this as memory corruption rather than confirmed remote code execution, which is a meaningful distinction for teams prioritizing patch rollout.

The Seven Critical Flaws at a Glance

• CVE-2026-103594 — CVSS 9.5 — WireGuard configuration — stack buffer overflow enabling remote code execution.
• CVE-2026-112710 — CVSS 9.2 — Active Directory service — heap buffer overflow, pre-authentication remote code execution.
• CVE-2026-112709 — CVSS 9.2 — Active Directory service — heap buffer overflow.
• CVE-2026-93865 — CVSS 9.2 — FireCluster sync daemon — missing authentication, root-level action injection.
• CVE-2026-93857 — CVSS 9.2 — SIP proxy — stack buffer overflow, pre-authentication remote code execution.
• CVE-2026-93866 — CVSS 9.2 — Access Portal — integer overflow, out-of-bounds write.
• CVE-2026-103593 — CVSS 9.1 — Logging service — stack buffer overflow enabling remote code execution.

Lower-Severity Bugs Still Worth Watching

Beyond the critical seven, two additional issues stand out for their potential impact despite lower scores. CVE-2026-90464 lets an already-authenticated attacker modify arbitrary files with root privileges because the affected component fails to validate commands properly, while CVE-2026-93864 allows a local attacker to overwrite arbitrary files as root by abusing a symlink-following flaw in firewalld. Neither requires remote, unauthenticated access, but both hand significant power to an attacker who has already gained a foothold.

Patch Availability

WatchGuard’s published fix guidance points to Fireware OS 2026.4 and 12.12.4 as the versions that resolve most of the listed issues, with T15 and T35 hardware requiring 12.5.22 specifically. The Windows Mobile VPN with SSL client’s separate credential-exposure issue is likewise resolved in the 2026.4 release. It’s worth noting this October disclosure is distinct from an earlier, separately tracked WatchGuard zero-day (CVE-2025-14733) that saw confirmed exploitation — there is no indication at this time that any of the 18 newly disclosed flaws have been exploited in the wild, though the combination of high severity and pre-authentication reachability makes rapid patching a priority for any organization running Firebox appliances.