Live › vulnerability › CVE-2026-93862
Go to dashboardA flaw in the FireCluster Sync processing of a firewall cluster lets an attacker on the cluster interconnect send crafted traffic that repeatedly crashes the cluster synchronization process. The result is a sustained denial of service on the firewall cluster.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Only firewalls running a FireCluster high-availability cluster are in scope, and the attacker must be on the cluster interconnect, such as a compromised peer or an on-path attacker on that link. Standalone firewalls and clusters whose interconnect is isolated from untrusted networks are less exposed. The sources do not name the affected firmware versions or product.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2025.1, < 2026.4; >= 12.0, < 12.12.4 | 2026.4, 12.12.4 |
| Fireware OS (T15/T35) | vendor | >= 12.0, < 12.5.22 | 12.5.22 |
show cluster), then its Fireware version: vulnerable if >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4; T15/T35: >= 12.0 and < 12.5.2212.12.4 (12.x), or 12.5.22 (T15/T35 models)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-93862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.