{"id":"CVE-2026-93864","kind":"vulnerability","aliases":["CVE-2026-93864"],"related":[],"title":"WatchGuard Fireware OS: local link following lets a low-privileged process overwrite root files","description":"A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.","summary":"A link following flaw in the firewall daemon of WatchGuard Fireware OS lets a local attacker who already runs code as a low-privileged system process plant a crafted file system object and trigger a list update. The attacker can then overwrite arbitrary files with root privileges and tamper with firewall IP set data, though the written content is partially constrained.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4"],"affected":">= 2025.1, < 2026.4; >= 12.0, < 12.12.4","ecosystem":"vendor"},{"name":"Fireware OS (T15/T35)","fixed":["12.5.22"],"affected":">= 12.0, < 12.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["firebox","firewall-appliance","fireware-os","infrastructure","local-privilege-escalation","watchguard"],"not_affected_if":["fireware-12.12.4-or-later","fireware-2026.4-or-later","no-watchguard-fireware","t15-t35-12.5.22-or-later"],"how_to_check":"Check the Fireware OS version on the Firebox (Web UI System Status, or CLI 'show system' / WatchGuard System Manager). Exposed if on Default platforms >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4; or on T15/T35 >= 12.0 and < 12.5.22.","fix":"Upgrade Fireware OS to 2026.4 or later (2025.1/2026.x line), 12.12.4 or later (12.x), or 12.5.22 or later on T15/T35 models.","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:20+00:00","updated_at":"2026-10-27T16:36:27+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-27T16:34:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"WatchGuard Fireware OS: local link following lets a low-privileged process overwrite root files","impact":"high","summary":"A link following flaw in the firewall daemon of WatchGuard Fireware OS lets a local attacker who already runs code as a low-privileged system process plant a crafted file system object and trigger a list update. The attacker can then overwrite arbitrary files with root privileges and tamper with firewall IP set data, though the written content is partially constrained.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firewall-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"root-level file overwrite and firewall IP set tampering on the appliance","analyst_note":"Find the affected and fixed Fireware OS versions and the vendor advisory in the NVD entry or WatchGuard's security page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-watchguard-fireware"],"who_is_affected":"WatchGuard Fireware OS firewall appliances are affected, and the attacker must first have code execution as a low-privileged system process on the device. Teams that do not run WatchGuard Fireware appliances can skip it. The sources do not list affected Fireware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000577,"input_tokens":3326,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Fireware OS versions and the vendor advisory in the NVD entry or WatchGuard's security page.","search":"'-2026':17A,20A '-93864':18A,21A 'allow':113C 'alreadi':57B 'applianc':30B 'arbitrari':83B,129C 'attack':55B,79B,116C 'code':59B,118C 'constrain':101B,158C 'content':98B,155C 'craft':69B,145C 'cve':16A,19A 'daemon':47B,112C 'data':94B,141C 'escal':38B 'execut':119C 'file':15A,70B,84B,130C,146C 'firebox':27B 'firewal':29B,46B,91B,111C,138C 'firewall-appli':28B 'firewar':2A,32B,50B,108C 'fireware':22A,24A 'fireware-o':31B 'flaw':43B 'follow':6A,42B,104C 'infrastructur':34B 'ip':92B,139C 'let':7A,52B 'link':5A,41B,103C 'list':76B,152C 'local':4A,36B,54B,115C 'local-privilege-escal':35B 'low':10A,63B,123C 'low-privileg':9A,62B,122C 'object':72B,148C 'os':3A,23A,25A,33B,51B,109C 'overwrit':13A,82B,128C 'partial':100B,157C 'plant':67B,143C 'privileg':11A,37B,64B,87B,124C,133C 'process':12A,66B,126C 'root':14A,86B,132C 'run':58B 'set':93B,140C 'system':65B,71B,125C,147C 't15/t35':26A 'tamper':89B,136C 'though':95B 'trigger':74B,150C 'updat':77B,153C 'vulner':105C 'watchguard':1A,39B,49B,107C 'written':97B,154C","nicknames":[],"mitigations":[],"who_affected":"WatchGuard Fireware OS firewall appliances are affected, and the attacker must first have code execution as a low-privileged system process on the device. Teams that do not run WatchGuard Fireware appliances can skip it. The sources do not list affected Fireware versions.","tier":"B","verified":{"fix":{"at":"2026-10-27T16:36:27Z","by":"analyst","run_id":886},"products":{"at":"2026-10-27T16:36:27Z","by":"analyst","run_id":886},"who_affected":{"at":"2026-10-27T16:36:27Z","by":"analyst","run_id":886}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93864","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93864:886","url":null,"severity":null,"published_at":"2026-10-27T16:36:27+00:00","modified_at":"2026-10-27T16:36:27+00:00","first_seen_at":"2026-10-27T16:36:27+00:00","fetched_at":"2026-10-27T16:36:27+00:00","note":"Read WatchGuard PSIRT advisory: affected/fixed versions, not exploited per vendor; no PoC searched/found; no mitigations or workaround listed. Verified fix/products/who_affected from vendor text."}],"documents":[{"id":6987,"url":"https://psirt.watchguard.com/CVE-2026-93864/","title":"WatchGuard PSIRT: CVE-2026-93864 Fireware OS Link Following in firewalld","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}