{"id":"CVE-2026-93862","kind":"vulnerability","aliases":["CVE-2026-93862"],"related":[],"title":"FireCluster Sync: out-of-bounds read lets cluster peer crash firewall","description":"An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.","summary":"A flaw in the FireCluster Sync processing of a firewall cluster lets an attacker on the cluster interconnect send crafted traffic that repeatedly crashes the cluster synchronization process. The result is a sustained denial of service on the firewall cluster.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4"],"affected":">= 2025.1, < 2026.4; >= 12.0, < 12.12.4","ecosystem":"vendor"},{"name":"Fireware OS (T15/T35)","fixed":["12.5.22"],"affected":">= 12.0, < 12.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["firecluster","firewall","fireware","high-availability","infrastructure","network-appliance","self-hosted","watchguard"],"not_affected_if":["isolated-cluster-interconnect","not-clustered","standalone-firebox","standalone-firewall"],"how_to_check":"Check whether the Firebox is in a FireCluster (Web UI: System Status > FireCluster, or CLI 'show cluster'), then its Fireware version: vulnerable if >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4; T15/T35: >= 12.0 and < 12.5.22. Standalone Fireboxes are not affected.","fix":"Upgrade Fireware OS to 2026.4 (2025.1 to 2026.3 branch), 12.12.4 (12.x), or 12.5.22 (T15/T35 models). Vendor lists no workaround.","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:19+00:00","updated_at":"2026-10-27T16:36:41+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-27T16:34:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FireCluster Sync: out-of-bounds read lets cluster peer crash firewall","impact":"low","summary":"A flaw in the FireCluster Sync processing of a firewall cluster lets an attacker on the cluster interconnect send crafted traffic that repeatedly crashes the cluster synchronization process. The result is a sustained denial of service on the firewall cluster.","category":"infrastructure","nicknames":[],"who_cares":["firewall","high-availability","firecluster","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Repeated crashes of cluster sync cause sustained denial of service","analyst_note":"Find the vendor advisory for CVE-2026-93862 to get affected firmware versions, fixed versions and any workaround; NVD URL in sources does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["standalone-firewall","isolated-cluster-interconnect"],"who_is_affected":"Only firewalls running a FireCluster high-availability cluster are in scope, and the attacker must be on the cluster interconnect, such as a compromised peer or an on-path attacker on that link. Standalone firewalls and clusters whose interconnect is isolated from untrusted networks are less exposed. The sources do not name the affected firmware versions or product.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00059,"input_tokens":3333,"output_tokens":513,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-93862 to get affected firmware versions, fixed versions and any workaround; NVD URL in sources does not list them.","search":"'-2026':14A,17A '-93862':15A,18A 'allow':90C 'applianc':33B 'attack':51B,92C,110C 'avail':29B 'bound':6A,82C 'cluster':9A,48B,54B,63B,77B,96C,102C,117C 'compromis':101C 'craft':57B,123C 'crash':11A,61B,113C 'cve':13A,16A 'denial':71B,130C 'fireclust':1A,24B,42B,87C 'firewal':12A,25B,47B,76B,115C 'firewar':26B 'fireware':19A,21A 'flaw':39B 'high':28B 'high-avail':27B 'host':36B 'infrastructur':30B 'interconnect':55B,97C 'let':8A,49B 'network':32B,109C,124C 'network-appli':31B 'on-path':106C 'os':20A,22A 'out-of-bound':3A,79C 'path':108C 'peer':10A,103C 'posit':93C 'process':44B,65B,89C,119C 'read':7A,83C 'repeat':60B,112C 'result':67B,126C 'self':35B 'self-host':34B 'send':56B,121C 'servic':73B,132C 'special':122C 'sustain':70B,129C 'sync':2A,43B,88C 'synchron':64B,118C 't15/t35':23A 'traffic':58B,125C 'vulner':84C 'watchguard':37B","nicknames":[],"mitigations":[],"who_affected":"Only firewalls running a FireCluster high-availability cluster are in scope, and the attacker must be on the cluster interconnect, such as a compromised peer or an on-path attacker on that link. Standalone firewalls and clusters whose interconnect is isolated from untrusted networks are less exposed. The sources do not name the affected firmware versions or product.","tier":"B","verified":{"fix":{"at":"2026-10-27T16:36:41Z","by":"analyst","run_id":887},"products":{"at":"2026-10-27T16:36:41Z","by":"analyst","run_id":887},"how_to_check":{"at":"2026-10-27T16:36:41Z","by":"analyst","run_id":887},"who_affected":{"at":"2026-10-27T16:36:41Z","by":"analyst","run_id":887}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93862","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93862:887","url":null,"severity":null,"published_at":"2026-10-27T16:36:41+00:00","modified_at":"2026-10-27T16:36:41+00:00","first_seen_at":"2026-10-27T16:36:41+00:00","fetched_at":"2026-10-27T16:36:41+00:00","note":"Read WatchGuard PSIRT advisory: High 7.2 (CVSS v4.0), CWE-125, not exploited per vendor, no workaround listed, no PoC/mitigations searched; social not searched."}],"documents":[{"id":6988,"url":"https://psirt.watchguard.com/CVE-2026-93862","title":"WatchGuard PSIRT: CVE-2026-93862 Out-of-Bounds Read in FireCluster Sync","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}