---
id: "CVE-2026-104381"
kind: "vulnerability"
aliases: ["CVE-2026-104381"]
title: "WatchGuard Fireware OS: unauthenticated cluster sync traffic can drop VPN tunnels"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firecluster", "firewall", "fireware-os", "infrastructure", "vpn", "watchguard"]
not_affected_if: ["isolated-sync-network", "no-firecluster", "standalone-device"]
published_at: "2026-10-27T16:17:28+00:00"
first_seen_at: "2026-10-27T16:33:06+00:00"
updated_at: "2026-10-27T16:34:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104381", "first_seen_at": "2026-10-27T16:33:06+00:00"}]
---

# WatchGuard Fireware OS: unauthenticated cluster sync traffic can drop VPN tunnels

Fireware OS's FireCluster state synchronization feature does not authenticate cluster sync traffic. An attacker on the cluster synchronization network segment can send crafted packets to force premature termination of VPN tunnels.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Fireware OS version on each firewall, for example in the web UI under System Status, and compare it with the fixed version listed by the vendor.
- Confirm whether FireCluster (high availability clustering) is configured, and which interfaces carry cluster synchronization traffic.

## Fix

- Upgrade Fireware OS to a fixed release. The fixed version is unknown from the sources.
- Restrict the cluster synchronization network segment so only the cluster members can reach it.

## Timeline

- 2026-10-27T16:33:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104381

## From the sources

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_