Description
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code.




This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Published: 2026-07-02
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an out‑of‑bounds write in the admd service of WatchGuard Fireware OS, leading to a buffer overflow and memory corruption (CWE-120 and CWE-787). An attacker who can reach the service from the same local network segment without authentication may send a crafted packet that triggers the overflow, allowing arbitrary code execution on the device. The advisory states that an unauthenticated attacker on the same local network segment can exploit this weakness.

Affected Systems

WatchGuard Fireware OS versions 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 are affected. The vulnerability is present in the admd component across these releases.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity, while the EPSS score of < 1 % and absence from the CISA KEV catalog suggest a low likelihood of exploitation at this time. The attack requires local network access to the admd service and no authentication. Once exploited, the flaw can lead to arbitrary code execution, giving an attacker full control over the affected device.

Generated by OpenCVE AI on August 13, 2026 at 21:43 UTC.

Remediation

Vendor Solution

Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.5.19, Fireware OS 12.11.9

OpenCVE Recommended Actions

  • Apply the latest patch or upgrade to a patched release of WatchGuard Fireware OS that resolves the out‑of‑bounds write flaw.
  • If an upgrade is not immediately possible, block or limit traffic to the admd port from non‑management network segments using firewall rules to prevent local‑segment reachability.
  • If the admd service must remain reachable, isolate it onto a dedicated management VLAN, enforce strict authentication, and restrict access to authorized management users only.
  • Enable detailed logging for the admd service to detect anomalous activity or payloads.

Generated by OpenCVE AI on August 13, 2026 at 21:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard firebox M5600
Watchguard firebox M5800
CPEs cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:*
Vendors & Products Watchguard firebox M5600
Watchguard firebox M5800

Thu, 13 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard firebox Cloud
Watchguard firebox M270
Watchguard firebox M290
Watchguard firebox M295
Watchguard firebox M370
Watchguard firebox M390
Watchguard firebox M395
Watchguard firebox M440
Watchguard firebox M4600
Watchguard firebox M470
Watchguard firebox M4800
Watchguard firebox M495
Watchguard firebox M570
Watchguard firebox M590
Watchguard firebox M595
Watchguard firebox M670
Watchguard firebox M690
Watchguard firebox M695
Watchguard firebox Nv5
Watchguard firebox T115-w
Watchguard firebox T125
Watchguard firebox T125-w
Watchguard firebox T145
Watchguard firebox T145-w
Watchguard firebox T15
Watchguard firebox T185
Watchguard firebox T20
Watchguard firebox T25
Watchguard firebox T35
Watchguard firebox T40
Watchguard firebox T45
Watchguard firebox T55
Watchguard firebox T70
Watchguard firebox T80
Watchguard firebox T85
Watchguard fireboxv
Watchguard fireware
Weaknesses CWE-787
CPEs cpe:2.3:a:watchguard:firebox_cloud:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:*
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
cpe:2.3:o:watchguard:fireware:11.12.4:-:*:*:*:*:*:*
cpe:2.3:o:watchguard:fireware:11.12.4:u1:*:*:*:*:*:*
Vendors & Products Watchguard firebox Cloud
Watchguard firebox M270
Watchguard firebox M290
Watchguard firebox M295
Watchguard firebox M370
Watchguard firebox M390
Watchguard firebox M395
Watchguard firebox M440
Watchguard firebox M4600
Watchguard firebox M470
Watchguard firebox M4800
Watchguard firebox M495
Watchguard firebox M570
Watchguard firebox M590
Watchguard firebox M595
Watchguard firebox M670
Watchguard firebox M690
Watchguard firebox M695
Watchguard firebox Nv5
Watchguard firebox T115-w
Watchguard firebox T125
Watchguard firebox T125-w
Watchguard firebox T145
Watchguard firebox T145-w
Watchguard firebox T15
Watchguard firebox T185
Watchguard firebox T20
Watchguard firebox T25
Watchguard firebox T35
Watchguard firebox T40
Watchguard firebox T45
Watchguard firebox T55
Watchguard firebox T70
Watchguard firebox T80
Watchguard firebox T85
Watchguard fireboxv
Watchguard fireware
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 10 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1		 cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
References

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Title WatchGuard Firebox admd Out of Bounds Write Vulnerability
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-120
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Firebox Cloud Firebox M270 Firebox M290 Firebox M295 Firebox M370 Firebox M390 Firebox M395 Firebox M440 Firebox M4600 Firebox M470 Firebox M4800 Firebox M495 Firebox M5600 Firebox M570 Firebox M5800 Firebox M590 Firebox M595 Firebox M670 Firebox M690 Firebox M695 Firebox Nv5 Firebox T115-w Firebox T125 Firebox T125-w Firebox T145 Firebox T145-w Firebox T15 Firebox T185 Firebox T20 Firebox T25 Firebox T35 Firebox T40 Firebox T45 Firebox T55 Firebox T70 Firebox T80 Firebox T85 Fireboxv Fireware Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-08-27T22:58:26.584Z

Reserved: 2026-05-10T12:48:43.918Z

Link: CVE-2026-8247

cve-icon Vulnrichment

Updated: 2026-07-06T15:46:54.782Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-03T00:16:52.773

Modified: 2026-08-28T00:18:22.920

Link: CVE-2026-8247

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T21:45:03Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-787

    Out-of-bounds Write