---
id: "CVE-2026-103594"
kind: "vulnerability"
aliases: ["CVE-2026-103594"]
title: "WatchGuard Fireware OS: WireGuard config overflow lets attackers run code"
severity: "critical"
cvss: 9.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fireware OS", "fixed": ["2026.4", "12.12.4"], "affected": ">= 2026.2, < 2026.4; >= 12.12, < 12.12.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firebox", "firecloud", "fireware-os", "infrastructure", "watchguard", "wireguard"]
not_affected_if: ["fireware-12.5", "fireware-2026.4-or-later", "no-firecloud-gateway", "no-watchguard-cloud", "no-wireguard-config"]
published_at: "2026-10-27T16:17:28+00:00"
first_seen_at: "2026-10-27T16:33:06+00:00"
updated_at: "2026-10-27T16:35:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103594", "first_seen_at": "2026-10-27T16:33:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T16:35:31+00:00"}]
---

# WatchGuard Fireware OS: WireGuard config overflow lets attackers run code

A stack-based buffer overflow in Fireware OS's WireGuard configuration processing can be triggered by tampering with a FireCloud Gateway configuration payload sent between a Firebox and WatchGuard Cloud. An attacker who can decrypt and modify that TLS traffic can cause a denial of service and potentially execute arbitrary code on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fireware OS affected >= 2026.2, < 2026.4; >= 12.12, < 12.12.4 fixed 2026.4, 12.12.4

## How to check

Check the Firebox Fireware version (Web UI System Status, or WatchGuard Cloud Device Firmware widget). Exposed if it is 2026.2 through 2026.3.x or 12.12 through 12.12.3 and the Firebox is set up as a FireCloud Gateway (WireGuard). Versions 12.5.x and older than 12.12 / 2026.2 are not listed as affected.

## Fix

Upgrade Fireware OS to 2026.4 or later (2026.2/2026.3 branch) or 12.12.4 or later (12.12 branch).

## Timeline

- 2026-10-27T16:33:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103594
- 2026-10-27T16:35:31+00:00 analyst — WatchGuard PSIRT index row (vendor's own page): CVSS 9.5, affected Fireware OS >=2026.2 <2026.4 and >=12.12 <12.12.4; fixed 2026.4 and 12.12.4. 12.5.x not listed. Detail page not retrievable; trigger conditions from NVD description only. No exploitation or PoC seen; no social search done.

## Documents

- [advisory] WatchGuard Security Advisories (CVE-2026-90464 row) https://psirt.watchguard.com/

## From the sources

A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_