WatchGuard advisories published October 27, 2026; fixed in Fireware OS 2026.4 and 12.12.4
WatchGuard Fixes 16 Fireware Flaws, Including Pre-Login Code Execution on the Firebox Itself
WatchGuard published 16 advisories on October 27, all fixed in Fireware OS 2026.4 and 12.12.4, with 12.5.22 covering the T15 and T35 models. The most serious entries are pre-login flaws on the firewall itself: heap buffer overflows in the Active Directory authentication service (CVE-2026-112709 and CVE-2026-112710, each rated 9.2) and a stack overflow in the SIP proxy (CVE-2026-93857, 9.2) allow code execution before any sign-in. A WireGuard configuration handling flaw (CVE-2026-103594) is rated 9.5 and needs an attacker positioned between the Firebox and WatchGuard Cloud. The set also includes a FireCluster synchronization flaw missing authentication that allows root actions (CVE-2026-93865, 9.2), a logging service stack overflow (CVE-2026-103593, 9.1), and an SSH login XPath injection that can expose configuration secrets (CVE-2026-93434, 8.7). WatchGuard does not list any of the 16 as exploited. The pattern matches the rest of this edition: the device deployed to be the boundary is carrying remotely reachable flaws of its own, and several of them need no credentials at all.
Executives
Small and midsize organizations run Fireboxes precisely because they consolidate protection into one device. That consolidation cuts both ways when the device itself needs an urgent update. The ask is modest: confirm your Firebox firmware version this week, and confirm that its management interfaces are not reachable from the internet while you wait for the maintenance window.
CIO / CISO
Schedule the upgrade to Fireware 2026.4 or 12.12.4, or 12.5.22 on T15 and T35 hardware, ahead of routine endpoint work, because three of these flaws are pre-authentication on services a firewall commonly exposes. Take a configuration backup first, and use the same window to verify that web and SSH management are limited to office addresses or a management VPN, consistent with the Protect function of the NIST Cybersecurity Framework.
Engineers
If the SIP proxy is not in use, turn it off rather than only patching it. Keep a FireCluster synchronization link on its own cable or an isolated VLAN, since the cluster flaw allows root actions without authentication on that path. After the upgrade, verify the running build on every cluster member, not just the first one that answers.
Everyone (non-IT)
If your office internet briefly drops during a firewall update this week, this is the likely reason, and it is the good kind of outage: planned, short, and closing holes that needed no password to exploit.