Live › vulnerability › CVE-2026-112709
Go to dashboardThe Fireware OS authentication service has a heap-based buffer overflow triggered by a specially crafted response from the configured Active Directory server. An attacker who controls or intercepts traffic to that AD server can cause a denial of service and potentially execute arbitrary code on the firewall.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Firewalls running Fireware OS that authenticate users against an Active Directory server are the ones in scope. Devices that do not use AD authentication, or whose AD traffic cannot be reached or intercepted by an attacker, are less exposed. Sources do not list the affected Fireware versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2025.1, < 2026.4; >= 12.0, < 12.12.4 | 2026.4, 12.12.4 |
| Fireware OS (T15/T35) | vendor | >= 12.0, < 12.5.22 | 12.5.22 |
show versionUpgrade Fireware OS to 2026.4 or later, or 12.12.4 or later; T15/T35 on the 12.5 line: 12.5.22 or later
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
This page as .md · .json · in your agent: get_signal("CVE-2026-112709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.