---
id: "CVE-2026-112709"
kind: "vulnerability"
aliases: ["CVE-2026-112709"]
title: "WatchGuard Fireware OS: heap overflow in auth service lets crafted AD response run code"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fireware OS", "fixed": ["2026.4", "12.12.4"], "affected": ">= 2025.1, < 2026.4; >= 12.0, < 12.12.4", "ecosystem": "vendor"}, {"name": "Fireware OS (T15/T35)", "fixed": ["12.5.22"], "affected": ">= 12.0, < 12.5.22", "ecosystem": "vendor"}]
ecosystems: []
tags: ["active-directory", "firewall", "fireware-os", "infrastructure", "self-hosted", "watchguard"]
not_affected_if: ["no-active-directory-auth"]
published_at: "2026-10-27T16:17:29+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:35:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112709", "first_seen_at": "2026-10-27T16:33:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T16:35:33+00:00"}]
---

# WatchGuard Fireware OS: heap overflow in auth service lets crafted AD response run code

The Fireware OS authentication service has a heap-based buffer overflow triggered by a specially crafted response from the configured Active Directory server. An attacker who controls or intercepts traffic to that AD server can cause a denial of service and potentially execute arbitrary code on the firewall.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fireware OS affected >= 2025.1, < 2026.4; >= 12.0, < 12.12.4 fixed 2026.4, 12.12.4
- vendor:Fireware OS (T15/T35) affected >= 12.0, < 12.5.22 fixed 12.5.22

## How to check

Check the Fireware version in Web UI (System Status) or CLI 'show version'. Exposed if below the fixed builds and an Active Directory authentication server is configured. Vendor's per-advisory text not read, so exposure conditions are unconfirmed.

## Fix

Upgrade Fireware OS to 2026.4 or later, or 12.12.4 or later; T15/T35 on the 12.5 line: 12.5.22 or later

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112709
- 2026-10-27T16:35:33+00:00 analyst — WatchGuard PSIRT index (psirt.watchguard.com) lists this as 9.2 pre-auth RCE, published 2026-10-27, with affected/fixed ranges. Per-advisory page not retrievable, so no how-to-check from vendor. Sibling CVE-2026-112710 has identical title and ranges: possible duplicate, left to code. No exploitation or PoC found; did not search X.

## Documents

- [advisory] WatchGuard Security Advisories (CVE-2026-90464 row) https://psirt.watchguard.com/

## From the sources

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_