Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-93865: WatchGuard Fireware OS remote attackers can run admin commands
CVE-2026-93865 · published 5 days ago
Summary
The Fireware OS component that synchronizes FireCluster devices does not check who is sending its requests. If clustering is turned on, an outsider could send a specially crafted message and cause the system to perform privileged actions, effectively gaining full control. Apply the latest software update from WatchGuard or disable the clustering feature until you can patch.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| watchguard | fireware os |
< 2026.4 < 12.5.22 |
Original advisory text
Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
References
- https://psirt.watchguard.com/CVE-2026-93865 vendor-advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-77Command Injection
CWE-306Missing Authentication for Critical Function
CWE-862Missing Authorization
Timeline
Published27 Oct 2026
Updated30 Oct 2026
First seen27 Oct 2026
Track software like this
Free during beta