{"id":"CVE-2026-93865","kind":"vulnerability","aliases":["CVE-2026-93865"],"related":[],"title":"WatchGuard Fireware OS: FireCluster daemon lets unauthenticated remote admin actions","description":"A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.","summary":"The FireCluster synchronization daemon in WatchGuard Fireware OS does not require authentication for certain requests sent to the FireCluster management IP. A remote attacker can invoke privileged system-level administrative actions without logging in.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firecluster","firewall","fireware-os","infrastructure","self-hosted","watchguard"],"not_affected_if":["clustering-disabled","standalone-appliance"],"how_to_check":"- Check whether FireCluster (high availability clustering) is enabled on the Firewall, which the description requires.\n- Confirm the Fireware OS version against the vendor advisory: unknown\n- Check the FireCluster management IP is reachable from untrusted networks: unknown","fix":"- Update Fireware OS to a fixed release: unknown (sources do not list versions)\n- Until patched, restrict access to the FireCluster management IP to trusted cluster peers only, or disable clustering if not in use.","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:33:59+00:00","updated_at":"2026-10-27T16:33:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T16:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update Fireware OS to a fixed release: unknown (sources do not list versions)\n- Until patched, restrict access to the FireCluster management IP to trusted cluster peers only, or disable clustering if not in use.","reach":"network","title":"WatchGuard Fireware OS: FireCluster daemon lets unauthenticated remote admin actions","impact":"high","summary":"The FireCluster synchronization daemon in WatchGuard Fireware OS does not require authentication for certain requests sent to the FireCluster management IP. A remote attacker can invoke privileged system-level administrative actions without logging in.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firecluster","firewall","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker performs privileged system administration on the firewall without credentials","analyst_note":"Find the WatchGuard advisory and fixed Fireware OS versions, and confirm the reachable interface and exposure conditions; the NVD entry alone gives no versions.","how_to_check":"- Check whether FireCluster (high availability clustering) is enabled on the Firewall, which the description requires.\n- Confirm the Fireware OS version against the vendor advisory: unknown\n- Check the FireCluster management IP is reachable from untrusted networks: unknown","needs_analyst":true,"not_affected_if":["clustering-disabled","standalone-appliance"],"who_is_affected":"WatchGuard Fireware OS appliances with the FireCluster clustering feature enabled are exposed, specifically through the FireCluster management IP. Appliances with clustering disabled are not affected per the description. Teams running standalone firewalls can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000651,"input_tokens":3311,"output_tokens":639,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93865':13A,16A 'action':10A,58B,84C 'admin':9A 'administr':57B,83C 'allow':72C 'attack':50B,76C 'authent':38B,63C 'certain':40B 'cluster':98C 'craft':89C 'cve':11A,14A 'daemon':5A,30B,71C 'enabl':101C 'featur':99C 'fireclust':4A,17B,28B,45B,69C,93C 'firewal':18B 'firewar':2A,20B,33B,67C 'fireware-o':19B 'host':25B 'infrastructur':22B 'invok':52B,78C 'ip':47B,95C 'let':6A 'level':56B,82C 'log':60B 'manag':46B,94C 'miss':62C 'os':3A,21B,34B,68C 'privileg':53B,79C 'remot':8A,49B,74C 'request':41B,90C 'requir':37B 'self':24B 'self-host':23B 'send':86C 'sent':42B 'special':88C 'synchron':29B,70C 'system':55B,81C 'system-level':54B,80C 'unauthent':7A,75C 'vulner':64C 'watchguard':1A,26B,32B 'without':59B","nicknames":[],"mitigations":[],"who_affected":"WatchGuard Fireware OS appliances with the FireCluster clustering feature enabled are exposed, specifically through the FireCluster management IP. Appliances with clustering disabled are not affected per the description. Teams running standalone firewalls can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93865","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}