TI-2026-81383 Aliases CVE-2026-103594 GHSA-69hq-vhp9-m5w6

Stack buffer overflow in Fireware OS WireGuard configuration processing

MEDIUM 43CWE-121Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

WatchGuard Fireware OS from 2026.2 before 2026.4 and from 12.12 before 12.12.4 is affected. A stack-based buffer overflow (CWE-121) in the processing of WireGuard configuration lets a remote attacker with man-in-the-middle access to TLS-decrypted traffic between the Firebox and WatchGuard Cloud cause a denial of service or potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00432 37th percentileScored 2026-11-07

Fix Fixed Fireware OS (WatchGuard): 2026.4, 12.12.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WatchGuard	Fireware OS	2026.2 to before 2026.4; 12.12 to before 12.12.4	2026.4, 12.12.4	Patch available	CNA

Fireware OS VendorWatchGuard Affected 2026.2 to before 2026.4; 12.12 to before 12.12.4 Fixed in 2026.4, 12.12.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:watchguard:fireware::::::::	—	—	WatchGuard

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard

Remediation

Upgrade Fireware OS to 2026.4 or 12.12.4. The sources do not list vendor advisory identifiers for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Fireware OS (WatchGuard) Fixed in 2026.4, 12.12.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-27
WatchGuard Fireware OS 12.12.4, 2026.4
17 records Highest priority Priority MEDIUM 9 MEDIUM, 8 LOW
Other records, highest priority first
- TI-2026-81380 Fireware OS FireCluster Daemon Lacks Authentication, Allows Remote Root ActionsPriority MEDIUM 48
- TI-2026-81377 Stack buffer overflow in WatchGuard Fireware OS SIP proxyPriority MEDIUM 48
- TI-2026-81386 NULL pointer dereference in WatchGuard Fireware OS management loginPriority MEDIUM 44
Show all 17 records →

Timeline

2026-10-27 Threatist record created from CVE-2026-103594
2026-10-27 Alias added: GHSA-69hq-vhp9-m5w6
2026-11-04 CISA SSVC decision points changed

References

Advisory 1

https://psirt.watchguard.com/CVE-2026-103594

TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5

See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences