{"id":"CVE-2026-90465","kind":"vulnerability","aliases":["CVE-2026-90465"],"related":[],"title":"FireCluster Sync: missing authentication lets cluster-link attacker run firewall management as root","description":"A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.","summary":"FireCluster Sync processing does not check authentication on certain requests. An attacker on the cluster interconnect can send a crafted request and invoke privileged firewall management actions as root.","severity":"high","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4"],"affected":">= 2025.1, < 2026.4; >= 12.0, < 12.12.4","ecosystem":"vendor"},{"name":"Fireware OS (T15/T35)","fixed":["12.5.22"],"affected":">= 12.0, < 12.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["firecluster","firewall","fireware","high-availability","infrastructure","self-hosted","watchguard"],"not_affected_if":["isolated-cluster-interconnect","not-clustered","standalone-deployment","standalone-firebox"],"how_to_check":"Check whether the Firebox is a FireCluster member (Web UI: System Status > FireCluster, or CLI 'show cluster'), then check Fireware version: vulnerable if >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4; T15/T35: >= 12.0 and < 12.5.22.","fix":"Upgrade Fireware OS to 2026.4 (2025.1 to 2026.3 branch), 12.12.4 (12.x), or 12.5.22 (T15/T35 models).","status":"open","published_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:33:54+00:00","updated_at":"2026-10-27T16:35:33+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-27T16:33:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FireCluster Sync: missing authentication lets cluster-link attacker run firewall management as root","impact":"high","summary":"FireCluster Sync processing does not check authentication on certain requests. An attacker on the cluster interconnect can send a crafted request and invoke privileged firewall management actions as root.","category":"infrastructure","nicknames":[],"who_cares":["firewall","high-availability","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gets root-level firewall management actions on the cluster node","analyst_note":"Find the vendor advisory and affected/fixed FireCluster versions and the sync port; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-90465 has only the description.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["standalone-deployment","isolated-cluster-interconnect"],"who_is_affected":"Teams running FireCluster high-availability firewall pairs or clusters, where the sync traffic runs over a cluster interconnect that an attacker could reach. Sites where the interconnect is physically isolated and only trusted peers can reach it are less exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000567,"input_tokens":3304,"output_tokens":474,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected/fixed FireCluster versions and the sync port; NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-90465 has only the description.","search":"'-2026':16A,19A '-90465':17A,20A 'action':63B,101C 'allow':75C 'attack':9A,48B,77C,95C 'authent':4A,43B,68C 'avail':31B 'certain':45B 'check':42B 'cluster':7A,51B,81C,87C 'cluster-link':6A 'compromis':86C 'craft':56B,108C 'cve':15A,18A 'fireclust':1A,26B,37B,72C 'firewal':11A,27B,61B,99C 'firewar':28B 'fireware':21A,23A 'high':30B 'high-avail':29B 'host':35B 'infrastructur':32B 'interconnect':52B,82C 'invok':59B,97C 'let':5A 'link':8A 'manag':12A,62B,100C 'miss':3A,67C 'network':94C 'on-path':91C 'os':22A,24A 'path':93C 'peer':88C 'posit':78C 'privileg':60B,98C 'process':39B,74C 'request':46B,57B,109C 'root':14A,65B,103C 'run':10A 'self':34B 'self-host':33B 'send':54B,105C 'special':107C 'sync':2A,38B,73C 't15/t35':25A 'vulner':69C 'watchguard':36B","nicknames":[],"mitigations":[],"who_affected":"Only Firebox appliances configured as members of a FireCluster (HA) are exposed. The attacker must be on the cluster interconnect, e.g. a compromised peer or on-path network attacker, so isolated dedicated sync links reduce risk. Standalone Fireboxes can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-27T16:35:33Z","by":"analyst","run_id":883},"products":{"at":"2026-10-27T16:35:33Z","by":"analyst","run_id":883},"who_affected":{"at":"2026-10-27T16:35:33Z","by":"analyst","run_id":883}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90465","severity":null,"published_at":"2026-10-27T16:17:31+00:00","modified_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-90465:883","url":null,"severity":null,"published_at":"2026-10-27T16:35:33+00:00","modified_at":"2026-10-27T16:35:33+00:00","first_seen_at":"2026-10-27T16:35:33+00:00","fetched_at":"2026-10-27T16:35:33+00:00","note":"Read WatchGuard PSIRT advisory: High 8.7 CVSS v4.0 (vendor), not exploited per vendor, sync port not stated. No PoC/mitigations found; did not search social."}],"documents":[{"id":6984,"url":"https://psirt.watchguard.com/CVE-2026-90465","title":"WatchGuard PSIRT: CVE-2026-90465 FireCluster Sync missing authentication","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}