{"id":"CVE-2026-104381","kind":"vulnerability","aliases":["CVE-2026-104381"],"related":[],"title":"WatchGuard Fireware OS: unauthenticated cluster sync traffic can drop VPN tunnels","description":"A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.","summary":"Fireware OS's FireCluster state synchronization feature does not authenticate cluster sync traffic. An attacker on the cluster synchronization network segment can send crafted packets to force premature termination of VPN tunnels.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firecluster","firewall","fireware-os","infrastructure","vpn","watchguard"],"not_affected_if":["isolated-sync-network","no-firecluster","standalone-device"],"how_to_check":"- Check the Fireware OS version on each firewall, for example in the web UI under System Status, and compare it with the fixed version listed by the vendor.\n- Confirm whether FireCluster (high availability clustering) is configured, and which interfaces carry cluster synchronization traffic.","fix":"- Upgrade Fireware OS to a fixed release. The fixed version is unknown from the sources.\n- Restrict the cluster synchronization network segment so only the cluster members can reach it.","status":"open","published_at":"2026-10-27T16:17:28+00:00","first_seen_at":"2026-10-27T16:33:06+00:00","triaged_at":"2026-10-27T16:34:24+00:00","updated_at":"2026-10-27T16:34:24+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-27T16:34:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Fireware OS to a fixed release. The fixed version is unknown from the sources.\n- Restrict the cluster synchronization network segment so only the cluster members can reach it.","reach":"network","title":"WatchGuard Fireware OS: unauthenticated cluster sync traffic can drop VPN tunnels","impact":"medium","summary":"Fireware OS's FireCluster state synchronization feature does not authenticate cluster sync traffic. An attacker on the cluster synchronization network segment can send crafted packets to force premature termination of VPN tunnels.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firecluster","firewall","vpn"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker forces VPN tunnels to terminate prematurely, disrupting connectivity.","analyst_note":"Find the vendor advisory and the fixed Fireware OS versions; the NVD entry alone does not list them.","how_to_check":"- Check the Fireware OS version on each firewall, for example in the web UI under System Status, and compare it with the fixed version listed by the vendor.\n- Confirm whether FireCluster (high availability clustering) is configured, and which interfaces carry cluster synchronization traffic.","needs_analyst":true,"not_affected_if":["standalone-device","no-firecluster","isolated-sync-network"],"who_is_affected":"Only firewalls running Fireware OS in a FireCluster high availability pair or cluster are exposed. The attacker must already be on the cluster synchronization network segment, not just on the internet or the general LAN. Standalone devices without FireCluster are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3303,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104381':14A,17A '-2026':13A,16A 'allow':70C 'attack':40B,73C 'authent':35B,60C 'cluster':5A,36B,43B,77C,90C 'craft':49B,89C 'cve':12A,15A 'drop':9A 'featur':32B,69C 'fireclust':18B,29B,66C 'firewal':19B 'firewar':2A,21B,26B,63C 'fireware-o':20B 'forc':52B,82C 'infrastructur':23B 'miss':59C 'network':45B,79C 'os':3A,22B,27B,64C 'packet':50B 'posit':74C 'prematur':53B,83C 'segment':46B,80C 'send':48B,88C 'state':30B,67C 'sync':6A,37B 'synchron':31B,44B,68C,78C,91C 'termin':54B,86C 'traffic':7A,38B,92C 'tunnel':11A,57B,85C 'unauthent':4A,72C 'vpn':10A,24B,56B,84C 'vulner':61C 'watchguard':1A,25B","nicknames":[],"mitigations":[],"who_affected":"Only firewalls running Fireware OS in a FireCluster high availability pair or cluster are exposed. The attacker must already be on the cluster synchronization network segment, not just on the internet or the general LAN. Standalone devices without FireCluster are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104381","severity":null,"published_at":"2026-10-27T16:17:28+00:00","modified_at":"2026-10-27T16:17:28+00:00","first_seen_at":"2026-10-27T16:33:06+00:00","fetched_at":"2026-10-27T16:33:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}