CVE-2026-93865

psirt.watchguard.com • November 2, 2026

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

Required Configuration for Exposure #

This vulnerability affects Firebox appliances that are configured as a member of a FireCluster.

Weakness Type and Impact #

CWE CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE CWE-306 Missing Authentication for Critical Function

CWE CWE-862 Missing Authorization

CAPEC CAPEC-88 OS Command Injection

CAPEC CAPEC-115 Authentication Bypass

Exploitation Status #

WatchGuard AI Security Research finder

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities Found in WatchGuard Fireware OS On October 27, 2026, WatchGuard disclosed 18 vulnerabilities in its Fireware OS and Mobile VPN with SSL client. Seventeen of these flaws impact Fireware OS, with CVSS scores ranging from 5.6 to 9.5, categorizing several as critical. Notably, CVE-2026-93857, CVE-2026-93865, and CVE-2026-93866 each have a CVSS score of 9.2. Some vulnerabilities can be exploited by remote, unauthenticated attackers if specific features are enabled. WatchGuard has stated it is unaware of any of these vulnerabilities. The Canadian Centre for Cyber Security has also issued an advisory urging users to apply the latest updates. Users are advised to upgrade to Fireware OS 2026.4 or 12.12.4, and VPN client users to 2026.4. As of November 2, 2026, none of the vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog. 2 sources 58

Extracted Entities

CVE-2026-93865

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (3)

MITRE ATT&CK (1)

Platforms (2)