Skip to content
OpenAdvisories
High NCSC-2026-0404 21 CVEs

Kwetsbaarheden verholpen in WatchGuard Fireware OS

Published Oct 7, 2026 · Updated Oct 7, 2026 · nl

Vendor: WatchGuard Product: Fireware Product: Fireware OS

Summary

WatchGuard heeft meerdere kwetsbaarheden verholpen in Fireware OS.

Details

Interpretaties
De impact van deze kwetsbaarheden varieert, net als de toegangsrechten die nodig zijn voor misbruik.

- Een aanvaller met schrijfrechten op het systeem kan via een kwetsbaarheid in SAML single sign-on-sessies een kwaadaardig sessiebestand laden en arbitraire code uitvoeren.
- Geauthenticeerde beheerders kunnen via path traversal in de WebUI Management Agent willekeurige lokale bestanden lezen. Een low-privileged geauthenticeerde gebruiker kan via resource-uitputting van diagnostische tools een denial-of-service veroorzaken.
- De spamBlocker-service bevat een stack-based buffer overflow die door een geauthenticeerde beheerder kan leiden tot een crash of code-executie.
- Een stack-based buffer overflow in de DHCP fingerprinting-daemon kan door een niet-geauthenticeerde aanvaller met netwerktoegang worden misbruikt voor code-executie of een crash.
- Een geauthenticeerde gebruiker met beperkte Access Portal-rechten kan via een SAML-login kwetsbaarheid ongeautoriseerde toegang tot Mobile VPN with SSL verkrijgen.
- Een remote, niet-geauthenticeerde aanvaller kan via resource-uitputting in het wgagent-loginproces een denial-of-service veroorzaken.
- De Access Portal reverse proxy bevat een improper authorization-kwetsbaarheid waardoor geauthenticeerde gebruikers met beperkte rechten toegang kunnen krijgen tot ongeautoriseerde webapplicaties.
- Een NULL pointer dereference in de NetFlow-packetverwerking kan door een remote, niet-geauthenticeerde aanvaller een crash veroorzaken.
- De BOVPN Over TLS-clientconfiguratie bevat een code-injection-kwetsbaarheid waardoor een aanvaller die de remote VPN-server beheert commando's met rootrechten kan uitvoeren op het Firebox-apparaat.
- Integer-underflow kwetsbaarheden in de IKE- en IKEv2-daemons kunnen door remote, niet-geauthenticeerde aanvallers worden misbruikt om crashes en daarmee denial-of-service te veroorzaken.
- Een NULL pointer dereference in het authenticatieproces kan door een remote, niet-geauthenticeerde aanvaller een crash van de managementdaemon veroorzaken.
- Een OS command injection in de interne API van WatchGuard Access Points kan door een aanvaller met netwerktoegang worden misbruikt voor het uitvoeren van willekeurige commando's.
- Een CSRF-kwetsbaarheid in WatchGuard Dimension kan het mogelijk maken om zonder toestemming database snapshots te creëren.
- Een missing authorization-kwetsbaarheid in de wgagent Management API kan door geauthenticeerde gebruikers met beperkte rechten worden misbruikt voor ongeautoriseerde API-verzoeken, crashes en het lezen van willekeurige bestanden.
- Een kwetsbaarheid in libxml2 kan leiden tot een out-of-bounds read en denial-of-service bij het verwerken van XML-input.

Oplossingen
WatchGuard heeft updates uitgebracht om de kwetsbaarheden in Fireware OS te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 21

  • Critical 9.6
    CVE-2026-86106

    Security Advisory 0179

    An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

    Arista Networks VeloCloud Edge Network devices Browsers
  • Critical 9.3
    CVE-2026-86102

    WatchGuard AP Command Injection in Internal Management API Allows Command Execution

    An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

    WatchGuard WatchGuard AP
  • Critical 9.2
    CVE-2026-86131

    Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

    A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-81433

    Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

    A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP pac…

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-86104

    Fireware OS Resource Exhaustion in Login Process Allows Denial of Service

    An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-86134

    Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service

    A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

    WatchGuard Fireware OS
  • High 8.6
    CVE-2026-18145

    Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution

    A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted m…

    WatchGuard Fireware OS
  • High 8.2
    CVE-2026-13224

    Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

    A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

    WatchGuard Fireware OS
  • High 8.2
    CVE-2026-86128

    Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

    A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

    WatchGuard Fireware OS
  • High 8.2
    CVE-2026-86132

    Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service

    An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.

    WatchGuard Fireware OS
  • High 8.2
    CVE-2026-86133

    Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service

    An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial o…

    WatchGuard Fireware OS
  • High 7.5
    CVE-2026-13046

    Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

    A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the …

    WatchGuard Fireware OS
  • High 7.2
    CVE-2026-18146

    Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

    The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient inp…

    WP ManageNinja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Web / CMS
  • High 7.2
    CVE-2026-86101

    Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access

    An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

    WatchGuard Fireware OS
  • High 7.1
    CVE-2026-18105

    Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

    An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diag…

    WatchGuard Fireware OS
  • High 7.1
    CVE-2026-86136

    Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …

    WatchGuard Fireware OS
  • High 7.1
    CVE-2026-90441

    Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …

    WatchGuard Fireware OS
  • High 7.0
    CVE-2026-86135

    Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service

    A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web …

    WatchGuard Dimension
  • Medium 5.3
    CVE-2026-13225

    Stored XSS in ticket confirmation page

    Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

    pretix pretix
  • Medium 5.3
    CVE-2026-86105

    Fireware OS Improper Authorization in Access Portal Reverse Proxy

    An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different…

    WatchGuard Fireware OS
  • Low 2.9
    CVE-2026-86137

    In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro …

    xmlsoft libxml2 libxml2 libxml2 Debian Azure Linux

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://psirt.watchguard.com/
  • Reference
    https://psirt.watchguard.com/CVE-2026-13046
  • Reference
    https://psirt.watchguard.com/CVE-2026-13224
  • Reference
    https://psirt.watchguard.com/CVE-2026-13225/
  • Reference
    https://psirt.watchguard.com/CVE-2026-18105
  • Reference
    https://psirt.watchguard.com/CVE-2026-18145
  • Reference
    https://psirt.watchguard.com/CVE-2026-18146/
  • Reference
    https://psirt.watchguard.com/CVE-2026-81433
  • Reference
    https://psirt.watchguard.com/CVE-2026-86101
  • Reference
    https://psirt.watchguard.com/CVE-2026-86102/
  • Reference
    https://psirt.watchguard.com/CVE-2026-86104
  • Reference
    https://psirt.watchguard.com/CVE-2026-86105
  • Reference
    https://psirt.watchguard.com/CVE-2026-86106/
  • Reference
    https://psirt.watchguard.com/CVE-2026-86128
  • Reference
    https://psirt.watchguard.com/CVE-2026-86131
  • Reference
    https://psirt.watchguard.com/CVE-2026-86132
  • Reference
    https://psirt.watchguard.com/CVE-2026-86133
  • Reference
    https://psirt.watchguard.com/CVE-2026-86134
  • Reference
    https://psirt.watchguard.com/CVE-2026-86135/
  • Reference
    https://psirt.watchguard.com/CVE-2026-86136
  • Reference
    https://psirt.watchguard.com/CVE-2026-86137/
  • Reference
    https://psirt.watchguard.com/CVE-2026-90441