Live › vulnerability › CVE-2026-103594
Go to dashboardA stack-based buffer overflow in Fireware OS's WireGuard configuration processing can be triggered by tampering with a FireCloud Gateway configuration payload sent between a Firebox and WatchGuard Cloud. An attacker who can decrypt and modify that TLS traffic can cause a denial of service and potentially execute arbitrary code on the appliance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Teams running WatchGuard Firebox appliances with Fireware OS that are managed through WatchGuard Cloud and use WireGuard configuration via FireCloud Gateway. The attack requires a man-in-the-middle position on the TLS-decrypted path between the Firebox and WatchGuard Cloud, so exposure is limited to that management path. Sources do not list affected Fireware versions, so teams without WireGuard or WatchGuard Cloud management can likely skip it, but this is unconfirmed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2026.2, < 2026.4; >= 12.12, < 12.12.4 | 2026.4, 12.12.4 |
12.12.3 and the Firebox is set up as a FireCloud Gateway (WireGuard)Upgrade Fireware OS to 2026.4 or later (2026.2/2026.3 branch) or 12.12.4 or later (12.12 branch).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-103594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.