---
id: "CVE-2026-113881"
kind: "vulnerability"
aliases: ["CVE-2026-113881"]
title: "WatchGuard Fireware OS: stack overflow in VPN access check lets authenticated users run code"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firebox", "fireware-os", "infrastructure", "mobile-vpn", "network-appliance", "watchguard"]
not_affected_if: ["no-mobile-vpn", "patched-version"]
published_at: "2026-10-27T16:17:30+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:34:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113881", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# WatchGuard Fireware OS: stack overflow in VPN access check lets authenticated users run code

A stack-based buffer overflow in the VPN Network Access Enforcement process of WatchGuard Fireware OS lets an authenticated mobile VPN user crash the service. The same flaw could let that user run arbitrary code as an unprivileged process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Fireware OS version on the appliance (System Status or `show version` in the CLI), and compare it with the fixed versions in the vendor advisory
- Confirm whether mobile VPN with SSL or IPSec is enabled and who holds mobile VPN user accounts

## Fix

- Upgrade Fireware OS to a fixed release listed in the WatchGuard advisory for CVE-2026-113881 (exact version unknown from these sources)
- Until patched, limit mobile VPN access to trusted users

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113881

## From the sources

A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_