An integer overflow in the WebSocket connection handling of WatchGuard Fireware OS’s Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer. The overflow could corrupt memory and enable arbitrary code execution or other destructive actions. The weakness is reflected by CWE-190 (Integer Overflow), CWE-288 (Authentication Bypass), and CWE-787 (Out-of-Bounds Write).

All versions of WatchGuard Fireware OS that include the Access Portal feature are impacted, until the release of the patched editions 2026.4, 12.12.4, or 12.5.22. The vulnerability specifically resides in the WebSocket subsystem used by the Access Portal, a component of the Fireware OS platform.

The vulnerability carries a CVSS score of 9.2, indicating a high severity. No EPSS score is currently available, so the exact exploitation probability is unknown, but the description implies that a simple crafted WebSocket request suffices, which makes the attack path relatively straightforward. The issue is not listed in CISA's KEV catalog, indicating no publicly known exploit at the time of reporting. Due to its remote, unauthenticated exposure, systems that expose the Access Portal to untrusted networks face significant risk.