Fireware OS contains a flaw that bypasses authentication for FireCluster Sync operations. An attacker who can reach the cluster interconnect—such as a compromised peer or an on‑path network attacker—can send specially crafted requests to trigger privileged firewall management actions as root. The weakness stems from missing authentication checks, allowing complete control over the device’s configuration and policy.

This issue affects all WatchGuard Fireware OS devices that enable FireCluster Sync. The affected releases are those prior to Fireware OS 2026.4, Fireware OS 12.12.4, or Fireware OS 12.5.22; the vendor recommends upgrading to any of these versions to eliminate the vulnerability.

The CVSS base score of 8.7 classifies the flaw as high severity, and while no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, the potential for exploitation is significant for attackers with access to the cluster interconnect. An on‑path or compromised peer can directly issue privileged commands as root, giving full administrative control over the device. The lack of authentication makes the attack step relatively straightforward once network access is achieved.