WatchGuard Fireware OS 2026.4 and 12.12.4 Fix 18 Flaws, Including Pre

On 27 October 2026, WatchGuard published 18 security advisories on its PSIRT portal : 17 for Fireware OS, the operating system on its Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The fixes ship in Fireware OS 2026.4 and 12.12.4, in 12.5.22 for the older T15 and T35 appliances, and in Mobile VPN with SSL client 2026.4. Five of the flaws can be reached by a remote attacker with no login. The three that matter most each need a specific feature to be turned on: CVE-2026-93857 in the SIP proxy, CVE-2026-93866 in the Access Portal and CVE-2026-93865 in FireCluster synchronization. All three carry a CVSS 4.0 score of 9.2, which is critical, from WatchGuard, the CVE Numbering Authority (CNA) for its products.

Several points narrow the risk. On every one of the 18 advisories, WatchGuard says it "is not aware of any exploitation of this vulnerability in the wild." As of 2 November 2026, 07:50 Cyprus time (UTC+2), the 18 CVEs are not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and we found no primary source reporting attacks or a public exploit. Most of the highest-scored flaws need a feature that is not used everywhere (SIP proxy, Access Portal, FireCluster, Active Directory authentication, FireCloud Gateway) or a privileged position on the network. NVD has not yet published its own scores; every record is "Awaiting Analysis".

Technical Information

What WatchGuard says ( PSIRT portal ; Fireware v2026.4 release notes ; Fireware v12.12.4 release notes ). The release notes say v2026.4 "includes several significant enhancements to Fireware, as well as important security fixes for Fireboxes," and for v12.12.4, "We strongly recommend that you upgrade your Firebox to prevent exposure." Both releases also update OpenSSH "to resolve multiple vulnerabilities"; WatchGuard does not list CVE IDs for that part.

Timeline (Cyprus time, UTC+2)

27 October: WatchGuard releases Fireware v2026.4 (build 750021) and v12.12.4 (build 749975).

27 October, 17:52: the 18 advisories appear on the PSIRT portal (time-stamped 15:52 UTC).

27 October, 18:17: the CVE records appear on NVD, all "Awaiting Analysis".

28 October: the Canadian Centre for Cyber Security publishes advisory AV26-1094 , pointing users to the WatchGuard advisories.

29 October: WatchGuard revises both sets of release notes and updates the Mobile VPN with SSL client advisory, CVE-2026-115495 .

2 November, 07:50: KEV catalog version 2026.10.30 lists none of the 18.

Flaws a remote attacker can reach without logging in, if the feature is enabled. Descriptions are WatchGuard's, shortened. Scores are the CNA's CVSS 4.0 base scores as shown on NVD.

Flaws that need a position on the network. These score near the top of the scale but require the attacker to control or intercept a connection the Firebox trusts:

A note on scores: for three CVEs, the score WatchGuard states does not match the CVSS 4.0 vector string it published. WatchGuard's advisory pages, and the score field in its CVE records , show CVE-2026-103593 at 9.1, CVE-2026-90465 at 8.7 and CVE-2026-82332 at 5.6. The vectors in those same records work out to 7.1, 9.4 and 5.7, and those are the scores NVD displays . We use the vector-based values in the tables above and will update this post if WatchGuard corrects either the score or the vector. The other 15 scores match.

Flaws that need a login or local access : CVE-2026-90442 (certd stack overflow, authenticated management access, 8.6), CVE-2026-90464 (a diagnostic CLI command lets a user with read-only Device Monitor rights or higher create or overwrite files as root, 7.2), CVE-2026-93864 (firewalld link following, needs code execution as a low-privileged process, 7.1), CVE-2026-113881 (Mobile VPN Network Access Enforcement, authenticated VPN user, 6.1), CVE-2026-82332 (AuthPoint MFA session hijack; the victim must accept a push notification, 5.7) and CVE-2026-115495 (Mobile VPN with SSL client for Windows sends the VPN username and password over a local loopback socket in cleartext, 5.7).

Exploitation status. WatchGuard reports no exploitation on any of the 18. Where CISA has attached its assessment to a CVE record (for example CVE-2026-93857 and CVE-2026-93865), it lists exploitation as "none". The 18 CVEs are not in KEV. Earlier Firebox flaws have been exploited: CISA added CVE-2025-9242 to its KEV catalog on 12 November 2025 and CVE-2025-14733 on 19 December 2025. That history is why Firebox fixes deserve prompt attention, but this post does not claim any attack on the 18 flaws fixed here.

Exposure is not compromise. A Firebox that runs an affected build but does not use the SIP proxy, the Access Portal or FireCluster is not exposed to the three top-scored no-login flaws above.

Affected Product Versions

Fixed versions come from each WatchGuard advisory ("Solution"):

Notes from the advisories:

CVE-2026-103594 affects only 2026.2 up to 2026.4 and 12.12 up to 12.12.4.

CVE-2026-113881 affects 12.x only from 12.9, and CVE-2026-82332 only from 12.7.

Per the release notes, v2026.4 covers Firebox T115-W, T125, T145, T175, T185, M295, M395, M495, M595, M695, M4850, M5850 and M6850. v12.12.4 covers NV5, T20, T25, T40, T45, T80, T85, M270, M290, M370, M390, M470, M570, M590, M670, M690, M4600, M4800, M5600, M5800, FireboxV and Firebox Cloud.

Workaround and Mitigation

Upgrade. Move to Fireware OS 2026.4 , 12.12.4 or 12.5.22 (T15/T35), and update Windows Mobile VPN with SSL clients to 2026.4, as listed on the WatchGuard advisories . WatchGuard lists no workaround in place of the upgrade.

Read the release-specific upgrade notes first. Both release notes point to known issues that matter when upgrading to or from specific versions.

Cut exposure while you schedule the upgrade (Rescana guidance, not WatchGuard's) . Turn off the Access Portal and the SIP proxy where they are not needed. Keep the management Web UI and SSH reachable only from trusted admin networks. Keep FireCluster interconnects and cluster management IPs off untrusted networks.

Check the trust paths the Firebox relies on (Rescana guidance) . Several flaws need an attacker to impersonate the AD server, the external log server or the WatchGuard Cloud connection, so make sure those links run over networks you control.

Watch for change. Track CISA KEV and WatchGuard's advisories for exploitation or revisions.

Indicators of Compromise

WatchGuard has published no indicators of compromise, and we found none from CISA or the Canadian Centre for Cyber Security. With no exploitation reported, there are none to . Unexpected crashes or restarts of the management, authentication or cluster services on a Firebox are worth a closer look (Rescana guidance; these are hunting ideas, not confirmed signs of attack) .

We will update this post if CISA adds any of the 18 CVEs to KEV, if WatchGuard or a national CERT reports exploitation, if WatchGuard revises an advisory or corrects a score, if NVD publishes its own scores, or if a public exploit is reported.

What to do with this vendor today

Fireboxes often sit at the edge of smaller suppliers and of networks run by managed service providers, so this release is a supplier-hygiene question rather than a breach story. The flaws that matter most depend on features a supplier may or may not use, so a vague "we patch regularly" does not answer it. A supplier that can quickly tell you its Fireware build, and whether its Access Portal, SIP proxy, FireCluster links and management interfaces are exposed, is showing that it knows its own edge.

Forward this to your TPRM owner: Send suppliers that run or manage WatchGuard Fireboxes a short, friendly check (Rescana guidance) :

Do you, or the provider that manages your network, run WatchGuard Fireboxes? Are they on Fireware 2026.4, 12.12.4 or 12.5.22 (T15/T35)?

Are the Access Portal, SIP proxy or FireCluster in use, and can any of them, or the management Web UI or SSH, be reached from the internet?

Have Windows users of Mobile VPN with SSL been moved to client 2026.4?

If a provider manages the firewall, can it show the installed version?

Want a second pair of eyes on which of your vendors sit behind affected WatchGuard Fireboxes? Our team can help you prioritize them and track their answers.

WatchGuard PSIRT: Security Advisories portal, 18 advisories published 27 October 2026: (per-CVE pages linked above, e.g. CVE-2026-93857: , CVE-2026-93866: , CVE-2026-93865: )

WatchGuard: Fireware v2026.4 Release Notes (release date 27 October 2026, revised 29 October 2026):

WatchGuard: Fireware v12.12.4 Release Notes (release date 27 October 2026, revised 29 October 2026):

Canadian Centre for Cyber Security: WatchGuard security advisory AV26-1094 (28 October 2026):

CVE Program (cve.org): WatchGuard CNA records, e.g. CVE-2026-103593: ; CVE-2026-90465: ; CVE-2026-82332:

NVD: CVE-2026-93857 (Awaiting Analysis; CNA score only): ; CVE-2026-93866: ; CVE-2026-93865: ; CVE-2026-103593: ; CVE-2026-90465: .

CISA: the 18 CVEs are not in KEV (catalog version 2026.10.30, checked 2 November 2026, 07:50 Cyprus time). Earlier Firebox entries CVE-2025-9242 (added 12 November 2025) and CVE-2025-14733 (added 19 December 2025) are listed. Catalog: