CVE 2026 103593

psirt.watchguard.com • October 29, 2026

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

Required Configuration for Exposure #

This vulnerability affects Firebox deployments in FIPS mode with an external log server configured.

Weakness Type and Impact #

CWE CWE-121 Stack-based Buffer Overflow

CWE CWE-787 Out-of-bounds Write

CAPEC CAPEC-100 Overflow Buffers

Exploitation Status #

WatchGuard AI Security Research finder

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Buffer Overflow Vulnerabilities in WatchGuard Fireware OS Multiple vulnerabilities have been identified in WatchGuard Fireware OS, including CVE-2026-112710, a heap-based buffer overflow in the authentication service, which allows attackers to create denial of service conditions and potentially execute arbitrary code. CVE-2026-93857 and CVE-2026-103593 are stack-based buffer overflow vulnerabilities that can be exploited by remote, unauthenticated attackers to execute arbitrary code. Affected systems include Firebox deployments configured with Active Directory authentication, SIP proxy, and external log servers in FIPS mode. WatchGuard has confirmed the existence of these vulnerabilities, with CVE-2026-112710 rated as with a CVSS score of 9.2. Patches are expected to be released shortly, and administrators are urged to monitor for updates. 1 sources 69

Extracted Entities

CVE 2026 103593

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (1)

Platforms (2)