{"id":"CVE-2026-93434","kind":"vulnerability","aliases":["CVE-2026-93434"],"related":[],"title":"WatchGuard Fireware OS: XPath injection in SSH login leaks configuration data","description":"An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.","summary":"WatchGuard Fireware OS has an XPath injection flaw in its SSH authentication process. A remote attacker who can reach the management SSH interface can send a crafted request to extract sensitive configuration data.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","fireware-os","infrastructure","ssh","watchguard"],"not_affected_if":["management-ssh-disabled"],"how_to_check":"- Check the installed Fireware OS version on the appliance (unknown: the sources do not list affected versions)\n- Confirm whether the management SSH interface is reachable from untrusted networks (unknown: the sources do not say how to check exposure)","fix":"- Move to a patched Fireware OS release (unknown: the sources do not name the fixed version)\n- Restrict management SSH access to trusted admin networks until patched","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:04+00:00","updated_at":"2026-10-27T16:34:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T16:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a patched Fireware OS release (unknown: the sources do not name the fixed version)\n- Restrict management SSH access to trusted admin networks until patched","reach":"network","title":"WatchGuard Fireware OS: XPath injection in SSH login leaks configuration data","impact":"medium","summary":"WatchGuard Fireware OS has an XPath injection flaw in its SSH authentication process. A remote attacker who can reach the management SSH interface can send a crafted request to extract sensitive configuration data.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firewall","ssh"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker extracts sensitive configuration data from the appliance","analyst_note":"Check the NVD entry and WatchGuard security advisory for affected Fireware OS versions, fixed release, and whether the flaw needs a specific SSH configuration.","how_to_check":"- Check the installed Fireware OS version on the appliance (unknown: the sources do not list affected versions)\n- Confirm whether the management SSH interface is reachable from untrusted networks (unknown: the sources do not say how to check exposure)","needs_analyst":true,"not_affected_if":["management-ssh-disabled"],"who_is_affected":"Appliances running WatchGuard Fireware OS with the management SSH interface reachable by an attacker. Sites that keep management SSH closed to untrusted networks have less exposure. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000613,"input_tokens":3298,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93434':14A,17A 'access':76C 'allow':70C 'attack':40B,74C 'authent':36B,68C 'configur':10A,56B,85C 'craft':51B,91C 'cve':12A,15A 'data':11A,57B,86C 'extract':54B,83C 'firewal':18B 'firewar':2A,20B,26B,64C 'fireware-o':19B 'flaw':32B 'infrastructur':22B 'inject':5A,31B,60C 'interfac':47B,81C 'leak':9A 'login':8A 'manag':45B,79C 'os':3A,21B,27B,65C 'process':37B,69C 'reach':43B 'remot':39B,72C 'request':52B,92C 'send':49B 'sensit':55B,84C 'special':90C 'ssh':7A,23B,35B,46B,67C,80C 'submit':88C 'unauthent':73C 'vulner':61C 'watchguard':1A,24B,25B,63C 'xpath':4A,30B,59C","nicknames":[],"mitigations":[],"who_affected":"Appliances running WatchGuard Fireware OS with the management SSH interface reachable by an attacker. Sites that keep management SSH closed to untrusted networks have less exposure. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93434","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}