An out‑of‑bounds read in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on‑path network attacker, to repeatedly crash the firewall’s cluster synchronization process by sending specially crafted network traffic. The crash causes the synchronization service to terminate, leading to a sustained denial of service that can disrupt inter‑firewall coordination and other firewall functions.

The vulnerability affects WatchGuard Fireware OS devices running any version that does not include the fix. The official fix is available in Fireware OS 2026.4, Fireware OS 12.12.4, and Fireware OS 12.5.22.

The CVSS score of 7.2 indicates a medium to high severity. The EPSS score is not available, but the lack of an internal indicator does not reduce the likelihood of exploitation; the exposed cluster interconnect is a network boundary that an attacker can reach from within the same VLAN or by compromising a cluster peer. The vulnerability is currently not listed in the CISA KEV catalog, but its ability to cause a sustained denial of service makes it attractive for targeted disruption. An attacker can repeatedly send malformed packets over the cluster link until the synchronization process terminates; this can be performed without authentication or privilege escalation as long as the attacker can communicate with the cluster interconnect or compromise a cluster peer.