{"id":"CVE-2026-112710","kind":"vulnerability","aliases":["CVE-2026-112710"],"related":[],"title":"WatchGuard Fireware OS: crafted Active Directory reply can crash or run code","description":"A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.","summary":"A heap buffer overflow in the Fireware OS authentication service is triggered when a malicious or intercepted Active Directory server returns a specially crafted response. The result is a denial of service and potentially arbitrary code execution on the firewall.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","firewall","fireware-os","infrastructure","watchguard"],"not_affected_if":["no-active-directory-auth"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:33:59+00:00","updated_at":"2026-10-27T16:33:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T16:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"WatchGuard Fireware OS: crafted Active Directory reply can crash or run code","impact":"high","summary":"A heap buffer overflow in the Fireware OS authentication service is triggered when a malicious or intercepted Active Directory server returns a specially crafted response. The result is a denial of service and potentially arbitrary code execution on the firewall.","category":"infrastructure","nicknames":[],"who_cares":["fireware-os","watchguard","firewall","active-directory"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the firewall or crashes it.","analyst_note":"Find the affected Fireware OS versions and the vendor advisory with fixed builds at the NVD entry's linked references (https://nvd.nist.gov/vuln/detail/CVE-2026-112710).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-active-directory-auth"],"who_is_affected":"Firewalls running Fireware OS whose authentication service is configured to talk to an Active Directory server. An attacker must control or intercept traffic to that AD server, so exposure depends on network path. Devices without AD authentication configured are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000571,"input_tokens":3307,"output_tokens":481,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112710':15A,18A '-2026':14A,17A 'activ':5A,20B,45B,93C 'active-directori':19B 'allow':82C 'arbitrari':62B,106C 'attack':84C 'authent':36B,80C 'base':71C 'buffer':30B,72C 'code':12A,63B,107C 'condit':102C 'configur':92C 'control':86C 'craft':4A,51B,112C 'crash':9A 'creat':97C 'cve':13A,16A 'denial':57B,99C 'directori':6A,21B,46B,94C 'execut':64B,105C 'exist':75C 'firewal':22B,67B 'firewar':2A,24B,34B,78C 'fireware-o':23B 'heap':29B,70C 'heap-bas':69C 'infrastructur':26B 'intercept':44B,88C 'malici':42B 'os':3A,25B,35B,79C 'overflow':31B,73C 'potenti':61B,104C 'repli':7A 'respons':52B,113C 'result':54B 'return':48B,109C 'run':11A 'server':47B,95C 'servic':37B,59B,81C,101C 'special':50B,111C 'traffic':89C 'trigger':39B 'vulner':74C 'watchguard':1A,27B","nicknames":[],"mitigations":[],"who_affected":"Firewalls running Fireware OS whose authentication service is configured to talk to an Active Directory server. An attacker must control or intercept traffic to that AD server, so exposure depends on network path. Devices without AD authentication configured are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112710","severity":null,"published_at":"2026-10-27T16:17:30+00:00","modified_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}