Live › vulnerability › CVE-2026-104381
Go to dashboardFireware OS's FireCluster state synchronization feature does not authenticate cluster sync traffic. An attacker on the cluster synchronization network segment can send crafted packets to force premature termination of VPN tunnels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Only firewalls running Fireware OS in a FireCluster high availability pair or cluster are exposed. The attacker must already be on the cluster synchronization network segment, not just on the internet or the general LAN. Standalone devices without FireCluster are not affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.
This page as .md · .json · in your agent: get_signal("CVE-2026-104381")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.