{"id":"CVE-2026-103594","kind":"vulnerability","aliases":["CVE-2026-103594"],"related":[],"title":"WatchGuard Fireware OS: WireGuard config overflow lets attackers run code","description":"A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.","summary":"A stack-based buffer overflow in Fireware OS's WireGuard configuration processing can be triggered by tampering with a FireCloud Gateway configuration payload sent between a Firebox and WatchGuard Cloud. An attacker who can decrypt and modify that TLS traffic can cause a denial of service and potentially execute arbitrary code on the appliance.","severity":"critical","cvss":9.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4"],"affected":">= 2026.2, < 2026.4; >= 12.12, < 12.12.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["firebox","firecloud","fireware-os","infrastructure","watchguard","wireguard"],"not_affected_if":["fireware-12.5","fireware-2026.4-or-later","no-firecloud-gateway","no-watchguard-cloud","no-wireguard-config"],"how_to_check":"Check the Firebox Fireware version (Web UI System Status, or WatchGuard Cloud Device Firmware widget). Exposed if it is 2026.2 through 2026.3.x or 12.12 through 12.12.3 and the Firebox is set up as a FireCloud Gateway (WireGuard). Versions 12.5.x and older than 12.12 / 2026.2 are not listed as affected.","fix":"Upgrade Fireware OS to 2026.4 or later (2026.2/2026.3 branch) or 12.12.4 or later (12.12 branch).","status":"open","published_at":"2026-10-27T16:17:28+00:00","first_seen_at":"2026-10-27T16:33:06+00:00","triaged_at":"2026-10-27T16:33:55+00:00","updated_at":"2026-10-27T16:35:31+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-27T16:33:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WatchGuard Fireware OS: WireGuard config overflow lets attackers run code","impact":"high","summary":"A stack-based buffer overflow in Fireware OS's WireGuard configuration processing can be triggered by tampering with a FireCloud Gateway configuration payload sent between a Firebox and WatchGuard Cloud. An attacker who can decrypt and modify that TLS traffic can cause a denial of service and potentially execute arbitrary code on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firebox","wireguard","firecloud"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Firebox appliance","analyst_note":"Find the affected Fireware OS versions and the vendor advisory with fixed builds at https://nvd.nist.gov/vuln/detail/CVE-2026-103594 and the WatchGuard security advisories page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-wireguard-config","no-watchguard-cloud"],"who_is_affected":"Teams running WatchGuard Firebox appliances with Fireware OS that are managed through WatchGuard Cloud and use WireGuard configuration via FireCloud Gateway. The attack requires a man-in-the-middle position on the TLS-decrypted path between the Firebox and WatchGuard Cloud, so exposure is limited to that management path. Sources do not list affected Fireware versions, so teams without WireGuard or WatchGuard Cloud management can likely skip it, but this is unconfirmed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000645,"input_tokens":3342,"output_tokens":621,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Fireware OS versions and the vendor advisory with fixed builds at https://nvd.nist.gov/vuln/detail/CVE-2026-103594 and the WatchGuard security advisories page.","search":"'-103594':13A,16A '-2026':12A,15A 'access':110C 'allow':96C 'applianc':81B 'arbitrari':77B,127C 'attack':8A,59B,99C 'base':30B,85C 'buffer':31B,86C 'caus':69B 'cloud':57B,116C 'code':10A,78B,128C 'condit':123C 'config':5A 'configur':38B,49B,94C,135C 'creat':118C 'cve':11A,14A 'decrypt':62B,109C 'denial':71B,120C 'execut':76B,126C 'firebox':19B,54B,113C 'firecloud':20B,47B,133C 'firewar':2A,22B,34B,90C 'fireware':17A 'fireware-o':21B 'gateway':48B,134C 'infrastructur':24B 'let':7A 'man':103C 'man-in-the-middl':102C 'middl':106C 'modifi':64B 'os':3A,18A,23B,35B,91C 'overflow':6A,32B,87C 'payload':50B,136C 'potenti':75B,125C 'process':39B,95C 'remot':98C 'run':9A 'sent':51B 'servic':73B,122C 'stack':29B,84C 'stack-bas':28B,83C 'tamper':44B,130C 'tls':66B,108C 'tls-decrypt':107C 'traffic':67B 'trigger':42B 'vulner':88C 'watchguard':1A,25B,56B,115C 'wireguard':4A,26B,37B,93C","nicknames":[],"mitigations":[],"who_affected":"Teams running WatchGuard Firebox appliances with Fireware OS that are managed through WatchGuard Cloud and use WireGuard configuration via FireCloud Gateway. The attack requires a man-in-the-middle position on the TLS-decrypted path between the Firebox and WatchGuard Cloud, so exposure is limited to that management path. Sources do not list affected Fireware versions, so teams without WireGuard or WatchGuard Cloud management can likely skip it, but this is unconfirmed.","tier":"B","verified":{"fix":{"at":"2026-10-27T16:35:31Z","by":"analyst","run_id":885},"products":{"at":"2026-10-27T16:35:31Z","by":"analyst","run_id":885}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103594","severity":null,"published_at":"2026-10-27T16:17:28+00:00","modified_at":"2026-10-27T16:17:28+00:00","first_seen_at":"2026-10-27T16:33:06+00:00","fetched_at":"2026-10-27T16:33:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103594:885","url":null,"severity":null,"published_at":"2026-10-27T16:35:31+00:00","modified_at":"2026-10-27T16:35:31+00:00","first_seen_at":"2026-10-27T16:35:31+00:00","fetched_at":"2026-10-27T16:35:31+00:00","note":"WatchGuard PSIRT index row (vendor's own page): CVSS 9.5, affected Fireware OS >=2026.2 <2026.4 and >=12.12 <12.12.4; fixed 2026.4 and 12.12.4. 12.5.x not listed. Detail page not retrievable; trigger conditions from NVD description only. No exploitation or PoC seen; no social search done."}],"documents":[{"id":6985,"url":"https://psirt.watchguard.com/","title":"WatchGuard Security Advisories (CVE-2026-90464 row)","kind":"advisory","source":"analyst","text":"WatchGuard PSIRT index row (psirt.watchguard.com, fetched 2026-10-27):\nSeverity 7.2 | CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | Affected: Default >= 2025.1, < 2026.4; >= 12.0, < 12.12.4. T15/T35 >= 12.0, < 12.5.22. Fixed: >= 2026.4, >= 12.12.4; T15/T35 >= 12.5.22 | Published 2026-10-27\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}