---
id: "CVE-2026-93865"
kind: "vulnerability"
aliases: ["CVE-2026-93865"]
title: "WatchGuard Fireware OS: FireCluster daemon lets unauthenticated remote admin actions"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firecluster", "firewall", "fireware-os", "infrastructure", "self-hosted", "watchguard"]
not_affected_if: ["clustering-disabled", "standalone-appliance"]
published_at: "2026-10-27T16:17:32+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:33:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93865", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# WatchGuard Fireware OS: FireCluster daemon lets unauthenticated remote admin actions

The FireCluster synchronization daemon in WatchGuard Fireware OS does not require authentication for certain requests sent to the FireCluster management IP. A remote attacker can invoke privileged system-level administrative actions without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether FireCluster (high availability clustering) is enabled on the Firewall, which the description requires.
- Confirm the Fireware OS version against the vendor advisory: unknown
- Check the FireCluster management IP is reachable from untrusted networks: unknown

## Fix

- Update Fireware OS to a fixed release: unknown (sources do not list versions)
- Until patched, restrict access to the FireCluster management IP to trusted cluster peers only, or disable clustering if not in use.

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93865

## From the sources

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_