{"id":"CVE-2026-113881","kind":"vulnerability","aliases":["CVE-2026-113881"],"related":[],"title":"WatchGuard Fireware OS: stack overflow in VPN access check lets authenticated users run code","description":"A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.","summary":"A stack-based buffer overflow in the VPN Network Access Enforcement process of WatchGuard Fireware OS lets an authenticated mobile VPN user crash the service. The same flaw could let that user run arbitrary code as an unprivileged process.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firebox","fireware-os","infrastructure","mobile-vpn","network-appliance","watchguard"],"not_affected_if":["no-mobile-vpn","patched-version"],"how_to_check":"- Check the Fireware OS version on the appliance (System Status or `show version` in the CLI), and compare it with the fixed versions in the vendor advisory\n- Confirm whether mobile VPN with SSL or IPSec is enabled and who holds mobile VPN user accounts","fix":"- Upgrade Fireware OS to a fixed release listed in the WatchGuard advisory for CVE-2026-113881 (exact version unknown from these sources)\n- Until patched, limit mobile VPN access to trusted users","status":"open","published_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:24+00:00","updated_at":"2026-10-27T16:34:24+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T16:34:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Fireware OS to a fixed release listed in the WatchGuard advisory for CVE-2026-113881 (exact version unknown from these sources)\n- Until patched, limit mobile VPN access to trusted users","reach":"network","title":"WatchGuard Fireware OS: stack overflow in VPN access check lets authenticated users run code","impact":"medium","summary":"A stack-based buffer overflow in the VPN Network Access Enforcement process of WatchGuard Fireware OS lets an authenticated mobile VPN user crash the service. The same flaw could let that user run arbitrary code as an unprivileged process.","category":"infrastructure","nicknames":[],"who_cares":["fireware-os","watchguard","firebox","mobile-vpn","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Denial of service on VPN service; possible unprivileged code execution","analyst_note":"Find the WatchGuard advisory and the list of affected and fixed Fireware OS versions via the NVD link; the sources do not give them.","how_to_check":"- Check the Fireware OS version on the appliance (System Status or `show version` in the CLI), and compare it with the fixed versions in the vendor advisory\n- Confirm whether mobile VPN with SSL or IPSec is enabled and who holds mobile VPN user accounts","needs_analyst":true,"not_affected_if":["no-mobile-vpn","patched-version"],"who_is_affected":"Organizations running WatchGuard Firebox appliances with Fireware OS and mobile VPN enabled, where remote users authenticate to the VPN. Exposure depends on the specific Fireware version, which the sources do not list. Sites without mobile VPN users, or with the affected version not in use, can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3312,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113881':17A,20A '-2026':16A,19A 'access':8A,43B,86C 'allow':89C 'applianc':31B 'arbitrari':67B,105C 'authent':11A,52B,91C 'base':36B,76C 'buffer':37B,77C 'check':9A 'code':14A,68B,106C 'condit':101C 'could':62B 'craft':115C 'crash':56B 'creat':96C 'cve':15A,18A 'denial':98C 'enforc':44B,87C 'execut':104C 'firebox':21B 'firewar':2A,23B,48B,81C 'fireware-o':22B 'flaw':61B 'infrastructur':25B 'let':10A,50B,63B 'mobil':27B,53B,92C 'mobile-vpn':26B 'network':30B,42B,85C 'network-appli':29B 'os':3A,24B,49B,82C 'overflow':5A,38B,78C 'potenti':103C 'process':45B,72B,88C,110C 'request':116C 'run':13A,66B 'send':112C 'servic':58B,100C 'special':114C 'stack':4A,35B,75C 'stack-bas':34B,74C 'unprivileg':71B,109C 'user':12A,55B,65B,94C 'vpn':7A,28B,41B,54B,84C,93C 'vulner':79C 'watchguard':1A,32B,47B","nicknames":[],"mitigations":[],"who_affected":"Organizations running WatchGuard Firebox appliances with Fireware OS and mobile VPN enabled, where remote users authenticate to the VPN. Exposure depends on the specific Fireware version, which the sources do not list. Sites without mobile VPN users, or with the affected version not in use, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113881","severity":null,"published_at":"2026-10-27T16:17:30+00:00","modified_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}