Live › vulnerability › CVE-2026-93864
Go to dashboardA link following flaw in the firewall daemon of WatchGuard Fireware OS lets a local attacker who already runs code as a low-privileged system process plant a crafted file system object and trigger a list update. The attacker can then overwrite arbitrary files with root privileges and tamper with firewall IP set data, though the written content is partially constrained.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
WatchGuard Fireware OS firewall appliances are affected, and the attacker must first have code execution as a low-privileged system process on the device. Teams that do not run WatchGuard Fireware appliances can skip it. The sources do not list affected Fireware versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2025.1, < 2026.4; >= 12.0, < 12.12.4 | 2026.4, 12.12.4 |
| Fireware OS (T15/T35) | vendor | >= 12.0, < 12.5.22 | 12.5.22 |
show system / WatchGuard System Manager)12.12.4; or on T15/T35 >= 12.0 and < 12.5.22Upgrade Fireware OS to 2026.4 or later (2025.1/2026.x line), 12.12.4 or later (12.x), or 12.5.22 or later on T15/T35 models.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.
This page as .md · .json · in your agent: get_signal("CVE-2026-93864")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.