Skip to content
ThreatCluster

Buffer Overflow Vulnerabilities in WatchGuard Fireware OS

First seen 29 Oct 2026, 19:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 20:45 UTC
  • •CVE-2026-112710 is a critical heap-based buffer overflow vulnerability with CVSS 9.2.
  • •CVE-2026-93857 and CVE-2026-103593 are stack-based buffer overflow vulnerabilities allowing arbitrary code execution.
  • •Affected systems include Firebox deployments with specific configurations, including Active Directory and SIP proxy.

Multiple vulnerabilities have been identified in WatchGuard Fireware OS, including CVE-2026-112710, a heap-based buffer overflow in the authentication service, which allows attackers to create denial of service conditions and potentially execute arbitrary code. CVE-2026-93857 and CVE-2026-103593 are stack-based buffer overflow vulnerabilities that can be exploited by remote, unauthenticated attackers to execute arbitrary code. Affected systems include Firebox deployments configured with Active Directory authentication, SIP proxy, and external log servers in FIPS mode. WatchGuard has confirmed the existence of these vulnerabilities, with CVE-2026-112710 rated as with a CVSS score of 9.2. Patches are expected to be released shortly, and administrators are urged to monitor for updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CVE-2026-112710 published
WatchGuard disclosed a critical heap-based buffer overflow vulnerability in Fireware OS affecting Active Directory configurations.
Psirt.Watchguard
2026-10-29
CVE-2026-93857 and CVE-2026-93866 published
WatchGuard disclosed two additional vulnerabilities, including a stack-based buffer overflow in the SIP proxy and an integer overflow in WebSocket handling.
psirt.watchguard.com
2026-10-29
CVE-2026-103593 published
WatchGuard disclosed another stack-based buffer overflow vulnerability in the logging service of Fireware OS.
psirt.watchguard.com

More articles in this cluster (4)

Following this threat?

Track WatchGuard and CVE-2026-112710 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which versions of Fireware OS are affected?
The vulnerabilities affect various versions of Fireware OS, particularly those configured with Active Directory, SIP proxy, and external log servers.
Is there evidence of exploitation in the wild?
Currently, there is no confirmed exploitation of these vulnerabilities in the wild.
What actions should administrators take?
Administrators should monitor for patches and updates from WatchGuard and ensure their configurations are secure.