Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

WatchGuard Fireware OS SIP proxy lets attacker run code

CVE-2026-93857 · published 5 days ago
Summary

The SIP (voice over IP) component of WatchGuard Fireware OS can be fooled by a specially crafted network request, letting an unauthenticated attacker run their own programs on the device. This could give them control over the firewall or network equipment. Install the latest WatchGuard update or patch that addresses the issue and restrict access to the SIP proxy wherever possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
watchguard fireware os < 2026.4
< 12.5.22
Original advisory text
Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
CWE-121Stack-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published27 Oct 2026
Updated30 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-93857 · NVD
CVE-2026-93857 · MITRE
Track software like this
Free during beta