An out‑of‑bounds write flaw in WatchGuard Fireware OS allows an authenticated privileged administrator to execute arbitrary code with root privileges. The vulnerability occurs on the exposed management interface and is a classic memory corruption error consistent with CWE‑787. The flaw permits complete control over the device by the attacker once it is exploited.

The affected products are WatchGuard Fireware OS versions 11.9, 11.10, 11.12, 11.12.4_Update1, 12.0 through 12.11.7, and 2025.1 through 2026.1.1. All Firebox hardware models running these OS releases are impacted when the management interface is reachable.

The CVSS v3 score of 8.6 reflects a high severity, while an EPSS score of less than 1% indicates that exploitation is currently unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Attacker intent requires valid privileged credentials, after which arbitrary code runs with root privileges. The likely attack vector is the exposed management interface, inferred from the description of the interface’s role in the flaw.