Description
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Published: 2026-10-27
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: Remote Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A missing authentication check in the Fireware OS FireCluster synchronization daemon allows an unauthenticated attacker to send a crafted request to the management IP when clustering is enabled, enabling them to invoke privileged system-level administrative actions. This flaw gives remote attacker root‑level control, allowing complete compromise of the device. The weakness stems from authentication bypass, command injection potential, and improper privilege management.

Affected Systems

The vulnerability affects WatchGuard Fireware OS devices, specifically versions that precede the vendor‑released fixes: Fireware OS 2026.4, 12.12.4, and 12.5.22. Any installation with the FireCluster feature enabled is susceptible under the current configuration.

Risk and Exploitability

The CVSS score of 9.2 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely, anonymously, by sending a specially crafted request to the FireCluster management IP when clustering is active. Successful exploitation allows full root‑level control, resulting in complete system compromise.

Generated by OpenCVE AI on October 27, 2026 at 18:19 UTC.

Remediation

Vendor Solution

Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22

OpenCVE Recommended Actions

  • Apply the vendor‑published patches for Fireware OS 2026.4, 12.12.4, or 12.5.22.
  • If patching cannot be performed immediately, disable the FireCluster feature to eliminate the vulnerable daemon.
  • Restrict access to the FireCluster management IP to trusted networks or apply firewall rules to block unsolicited traffic.

Generated by OpenCVE AI on October 27, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Title Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-306
CWE-77
CWE-862
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-10-27T15:52:27.668Z

Reserved: 2026-09-18T19:23:54.317Z

Link: CVE-2026-93865

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T16:17:32.843

Modified: 2026-10-27T16:17:32.843

Link: CVE-2026-93865

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T18:30:08Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-862

    Missing Authorization