WatchGuard Fireware OS October 2026 patches (CVE-2026-103594 and 17 other flaws): versions to install
WatchGuard fixes 18 flaws, several critical, in Fireware OS and Mobile VPN with SSL. Versions 2026.4, 12.12.4 and 12.5.22, priorities and checks.
The short answer: on 27 October 2026, WatchGuard published 18 security advisories covering Fireware OS, the operating system of Firebox firewalls, and the Mobile VPN with SSL client for Windows. Several flaws are critical and, in some configurations, allow unauthenticated remote code execution. The fixed versions are Fireware OS 2026.4, 12.12.4 and 12.5.22 (for the T15 and T35). WatchGuard is not aware of any exploitation, but Morocco’s maCERT (DGSSI) rated the batch at a critical risk level on 28 October.
For many SMBs in Morocco, the Firebox is the network’s front door: it filters internet traffic, carries remote workers’ VPNs, links branch offices and often lets IP telephony through. A vulnerable firewall is an open door to everything behind it. This alert brings together what the official sources say and the checks to carry out. For how the appliance works in general, see our WatchGuard Firebox guide for SMBs.
What is affected
The 27 October batch covers a range of components. The most severe flaws, all rated critical by WatchGuard under CVSS v4.0, are:
- CVE-2026-103594 (9.5): stack overflow in WireGuard configuration processing. An attacker able to intercept and decrypt traffic between the Firebox and WatchGuard Cloud can tamper with the configuration sent and cause a denial of service, or possibly execute code. Only Fireboxes configured as a FireCloud gateway are affected, on the 2026.2 and 12.12 branches.
- CVE-2026-93857 (9.2): stack overflow in the SIP proxy, exploitable without authentication through a request sent via a policy that uses this proxy. A point to watch for companies whose IP telephony runs through the Firebox.
- CVE-2026-93866 (9.2): integer overflow in the Access Portal, exploitable without authentication when the feature is enabled.
- CVE-2026-112709 and CVE-2026-112710 (9.2): heap overflows in the Active Directory authentication service. The attacker must control or intercept traffic to the configured AD server.
- CVE-2026-93865 (9.2): missing authentication in the FireCluster sync daemon, allowing privileged administrative actions to be injected through the cluster management address.
- CVE-2026-103593 (9.1): stack overflow in the logging service, only in FIPS mode with an external log server.
These come with flaws rated high or medium: extraction of configuration secrets through unauthenticated SSH authentication (CVE-2026-93434), unauthenticated denial of service on the management interface (CVE-2026-111107), further FireCluster flaws (CVE-2026-90465, CVE-2026-93862, CVE-2026-104381), file modification as root by an authenticated administrator (CVE-2026-90464), AuthPoint MFA session hijacking (CVE-2026-82332), plus CVE-2026-113881, CVE-2026-90442 and CVE-2026-93864.
| Product | Affected versions | Fixed version |
|---|---|---|
| Fireware OS (2025/2026 branch) | 2025.1 and later, earlier than 2026.4 | 2026.4 |
| Fireware OS (12.x branch) | 12.0 and later, earlier than 12.12.4 | 12.12.4 |
| Fireware OS on Firebox T15 and T35 | 12.x earlier than 12.5.22 | 12.5.22 |
| Mobile VPN with SSL, Windows client | 12.0 and later, earlier than 2026.4 | 2026.4 |
Source: WatchGuard PSIRT advisories published on 27 October 2026 and maCERT bulletin 67162810/26. Some flaws only affect part of these branches (CVE-2026-103594, for instance, is limited to versions 2026.2 and 12.12): updating to the fixed version of your branch covers them all.
Severity and exploitation
- Published severity: WatchGuard assigns CVSS v4.0 scores of up to 9.5, for CVE-2026-103594; NVD carries the vendor’s scores, with its own analysis still pending. Morocco’s maCERT (DGSSI) rates the batch at a critical risk and impact level, listing remote code execution, privilege escalation, access to confidential information and denial of service as risks.
- Exploitation: for each advisory, WatchGuard states it is not aware of any exploitation. None of these CVEs is in the CISA KEV catalogue at the time of writing. The catalogue does list older Firebox flaws, a reminder that these appliances attract attackers.
- Conditions: most critical flaws require a specific feature to be enabled or an attacker able to intercept a traffic flow. That is no reason to delay: these conditions are common in SMB configurations.
Interim measures, if the update has to wait a few hours
The WatchGuard advisories offer no workaround. The following steps reduce exposure without replacing the update:
- Restrict management access: web management interface and SSH reachable only from the internal network or a list of trusted addresses, never from the whole internet.
- Disable what is unused: Access Portal, SIP proxy, unused integrations.
- Isolate the FireCluster link: the cluster sync interface should stay on a dedicated link carrying no other traffic.
- Monitor: alerts on unexpected service restarts, unusual administrative logins and configuration changes.
Checks to carry out
- Inventory your Fireboxes: model, Fireware branch and running version, including branch-office appliances, FireboxV and Firebox Cloud.
- Identify the affected features: SIP proxy, Access Portal, Active Directory authentication, AuthPoint, FireCluster, FireCloud gateway, FIPS mode with an external log server. These appliances go to the top of the list.
- Plan the update: back up the configuration, book a maintenance window, then check the version shown after reboot. For a cluster, update both members.
- Update the endpoints: Mobile VPN with SSL client to 2026.4 on Windows PCs, following the method in our article on WatchGuard Mobile VPN for remote work.
- Review the logs: administrative and SSH logins from unknown addresses, newly added accounts, recently modified policies.
Our view for businesses in Morocco
Two situations come up often. The first: IP telephony crossing the Firebox with the SIP proxy enabled, sometimes without the team knowing. If that is your case, also read our best practices to secure 3CX. The second: the management interface left open to the internet “for remote troubleshooting”. It should be closed, whether or not the update is done.
A firewall update needs preparation. It fits into a wider approach: MFA with WatchGuard AuthPoint for remote access, managed 24/7 EDR and monitoring to spot abnormal activity, and compliance with Law 05-20 and DGSSI requirements for the organisations concerned.
How we can help
As a WatchGuard partner in Morocco, we inventory your Fireboxes, apply Fireware OS 2026.4, 12.12.4 or 12.5.22 in a controlled window, close exposed management access, update VPN clients and check for suspicious traces. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: WatchGuard PSIRT security advisories, CVE-2026-103594, CVE-2026-93857, CVE-2026-93866, CVE-2026-112709, CVE-2026-93865, CVE-2026-115495, Fireware release notes, NVD CVE-2026-93857, CISA KEV catalogue, maCERT bulletin 67162810/26 (DGSSI).
Frequently asked questions
Is my Firebox affected?
Yes if it runs Fireware OS 2025.1 or later but earlier than 2026.4, 12.0 or later but earlier than 12.12.4, or, for the T15 and T35, a 12.x version earlier than 12.5.22. Several critical flaws only affect specific features (SIP proxy, Access Portal, Active Directory authentication, FireCluster, FireCloud gateway), but the update applies to every appliance.
Are these flaws being exploited?
For each advisory, WatchGuard states it is not aware of any exploitation. At the time of writing, none of these CVEs is listed in the CISA KEV catalogue. Morocco’s maCERT (DGSSI) nevertheless rates them at a critical risk level (bulletin 67162810/26).
Is there a workaround if I cannot update right away?
The WatchGuard advisories list no workaround: the only solution given is the update. In the meantime, reducing exposure of the affected features (management interface and SSH restricted to the internal network, Access Portal or SIP proxy disabled if unused) lowers the risk without removing it.
Do remote workers’ PCs need updating too?
Yes for those using Mobile VPN with SSL on Windows. CVE-2026-115495 exposes the VPN username and password to an attacker with local access to the PC. Client versions from 12.0 up to but not including 2026.4 are affected; version 2026.4 is fixed.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
