Live › vulnerability › CVE-2026-90465
Go to dashboardFireCluster Sync processing does not check authentication on certain requests. An attacker on the cluster interconnect can send a crafted request and invoke privileged firewall management actions as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Only Firebox appliances configured as members of a FireCluster (HA) are exposed. The attacker must be on the cluster interconnect, e.g. a compromised peer or on-path network attacker, so isolated dedicated sync links reduce risk. Standalone Fireboxes can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2025.1, < 2026.4; >= 12.0, < 12.12.4 | 2026.4, 12.12.4 |
| Fireware OS (T15/T35) | vendor | >= 12.0, < 12.5.22 | 12.5.22 |
Check whether the Firebox is a FireCluster member (Web UI: System Status > FireCluster, or CLI show cluster), then check Fireware version: vulnerable if >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4; T15/T35: >= 12.0 and < 12.5.22.
Upgrade Fireware OS to 2026.4 (2025.1 to 2026.3 branch), 12.12.4 (12.x), or 12.5.22 (T15/T35 models).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
This page as .md · .json · in your agent: get_signal("CVE-2026-90465")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.