---
id: "CVE-2026-90442"
kind: "vulnerability"
aliases: ["CVE-2026-90442"]
title: "WatchGuard Fireware OS: certd buffer overflow lets an authenticated user crash or run code"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firebox", "fireware-os", "infrastructure", "network-appliance", "watchguard"]
not_affected_if: ["fixed-fireware-version", "management-interface-restricted"]
published_at: "2026-10-27T16:17:31+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:34:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90442", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# WatchGuard Fireware OS: certd buffer overflow lets an authenticated user crash or run code

A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS lets an attacker who can reach the Firebox management interface crash the service. The sources say it could also be used to execute arbitrary code via a specially crafted request.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Fireware OS version on the Firebox device (System Status or `show version` in the CLI) and compare it against the fixed version in the vendor advisory.
- Confirm whether the management interface (Web UI / CLI) is reachable from untrusted networks.

## Fix

- Upgrade Fireware OS to the fixed release listed in the WatchGuard advisory (version unknown from the sources).
- Restrict access to the Firebox management interface to trusted administrative networks.

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90442

## From the sources

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_