Live › vulnerability › CVE-2026-93866
Go to dashboardAn integer overflow in the WebSocket handling of WatchGuard Fireware OS's Access Portal lets a remote attacker write past the end of a heap buffer. The sources do not say whether this leads to code execution, but the memory corruption is reachable without credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Organizations running WatchGuard Fireware OS firewalls with the Access Portal feature enabled are exposed, since the flaw is triggered by a crafted WebSocket request to that feature. Devices with Access Portal disabled, or teams running other vendors' firewalls, can skip it. The sources do not list affected Fireware versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-93866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.