{"id":"CVE-2026-112709","kind":"vulnerability","aliases":["CVE-2026-112709"],"related":[],"title":"WatchGuard Fireware OS: heap overflow in auth service lets crafted AD response run code","description":"A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.","summary":"The Fireware OS authentication service has a heap-based buffer overflow triggered by a specially crafted response from the configured Active Directory server. An attacker who controls or intercepts traffic to that AD server can cause a denial of service and potentially execute arbitrary code on the firewall.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4"],"affected":">= 2025.1, < 2026.4; >= 12.0, < 12.12.4","ecosystem":"vendor"},{"name":"Fireware OS (T15/T35)","fixed":["12.5.22"],"affected":">= 12.0, < 12.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["active-directory","firewall","fireware-os","infrastructure","self-hosted","watchguard"],"not_affected_if":["no-active-directory-auth"],"how_to_check":"Check the Fireware version in Web UI (System Status) or CLI 'show version'. Exposed if below the fixed builds and an Active Directory authentication server is configured. Vendor's per-advisory text not read, so exposure conditions are unconfirmed.","fix":"Upgrade Fireware OS to 2026.4 or later, or 12.12.4 or later; T15/T35 on the 12.5 line: 12.5.22 or later","status":"open","published_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:00+00:00","updated_at":"2026-10-27T16:35:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-27T16:34:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WatchGuard Fireware OS: heap overflow in auth service lets crafted AD response run code","impact":"high","summary":"The Fireware OS authentication service has a heap-based buffer overflow triggered by a specially crafted response from the configured Active Directory server. An attacker who controls or intercepts traffic to that AD server can cause a denial of service and potentially execute arbitrary code on the firewall.","category":"infrastructure","nicknames":[],"who_cares":["fireware-os","watchguard","firewall","active-directory","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Firewall crashes or attacker runs arbitrary code on the device","analyst_note":"Find affected and fixed Fireware OS versions and the vendor advisory from the WatchGuard security page; NVD source only gives the description and CVSS 9.2.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-active-directory-auth"],"who_is_affected":"Firewalls running Fireware OS that authenticate users against an Active Directory server are the ones in scope. Devices that do not use AD authentication, or whose AD traffic cannot be reached or intercepted by an attacker, are less exposed. Sources do not list the affected Fireware versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000579,"input_tokens":3305,"output_tokens":496,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected and fixed Fireware OS versions and the vendor advisory from the WatchGuard security page; NVD source only gives the description and CVSS 9.2.","search":"'-112709':17A,20A '-2026':16A,19A 'activ':27B,59B,111C 'active-directori':26B 'ad':11A,71B 'allow':100C 'arbitrari':82B,124C 'attack':63B,102C 'auth':7A 'authent':41B,98C 'base':47B,90C 'buffer':48B,91C 'caus':74B 'code':14A,83B,125C 'condit':120C 'configur':58B,110C 'control':65B,104C 'craft':10A,54B,130C 'creat':115C 'cve':15A,18A 'denial':76B,117C 'directori':28B,60B,112C 'execut':81B,123C 'firewal':29B,86B 'firewar':2A,31B,39B,96C 'fireware':21A,23A 'fireware-o':30B 'heap':4A,46B,89C 'heap-bas':45B,88C 'host':36B 'infrastructur':33B 'intercept':67B,106C 'let':9A 'os':3A,22A,24A,32B,40B,97C 'overflow':5A,49B,92C 'potenti':80B,122C 'respons':12A,55B,131C 'return':127C 'run':13A 'self':35B 'self-host':34B 'server':61B,72B,113C 'servic':8A,42B,78B,99C,119C 'special':53B,129C 't15/t35':25A 'traffic':68B,107C 'trigger':50B 'vulner':93C 'watchguard':1A,37B","nicknames":[],"mitigations":[],"who_affected":"Firewalls running Fireware OS that authenticate users against an Active Directory server are the ones in scope. Devices that do not use AD authentication, or whose AD traffic cannot be reached or intercepted by an attacker, are less exposed. Sources do not list the affected Fireware versions.","tier":"B","verified":{"fix":{"at":"2026-10-27T16:35:33Z","by":"analyst","run_id":884},"products":{"at":"2026-10-27T16:35:33Z","by":"analyst","run_id":884}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112709","severity":null,"published_at":"2026-10-27T16:17:29+00:00","modified_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112709:884","url":null,"severity":null,"published_at":"2026-10-27T16:35:33+00:00","modified_at":"2026-10-27T16:35:33+00:00","first_seen_at":"2026-10-27T16:35:33+00:00","fetched_at":"2026-10-27T16:35:33+00:00","note":"WatchGuard PSIRT index (psirt.watchguard.com) lists this as 9.2 pre-auth RCE, published 2026-10-27, with affected/fixed ranges. Per-advisory page not retrievable, so no how-to-check from vendor. Sibling CVE-2026-112710 has identical title and ranges: possible duplicate, left to code. No exploitation or PoC found; did not search X."}],"documents":[{"id":6985,"url":"https://psirt.watchguard.com/","title":"WatchGuard Security Advisories (CVE-2026-90464 row)","kind":"advisory","source":"analyst","text":"WatchGuard PSIRT index row (psirt.watchguard.com, fetched 2026-10-27):\nSeverity 7.2 | CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | Affected: Default >= 2025.1, < 2026.4; >= 12.0, < 12.12.4. T15/T35 >= 12.0, < 12.5.22. Fixed: >= 2026.4, >= 12.12.4; T15/T35 >= 12.5.22 | Published 2026-10-27\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}