Act nowDisclosed

Advisory · CVE-2026-93857

Unauthenticated code execution in WatchGuard Fireware OS SIP proxy

WatchGuard Fireware OS contains a stack-based buffer overflow in its SIP proxy that allows a remote unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. CVSS 4.0 9.2.

Advisory published October 27, 2026Independent summary
Vendor
WatchGuard
Product
Fireware OS
Identifier / CWE
CVE-2026-93857
CWE-120, CWE-121, CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

The firewall's phone-traffic proxy copies incoming data into a fixed-size space without checking the size. A remote stranger can send an oversized crafted request and overwrite the firewall's own instructions.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Policy uses SIP proxy

    The firewall has a policy that passes traffic through the SIP proxy.

  2. 02Crafted request sent

    A remote unauthenticated attacker sends a specially crafted request through that policy.

  3. 03Buffer overflows

    The SIP proxy's stack buffer overflows while handling the request.

  4. 04Code executes

    The attacker executes arbitrary code on the firewall.

What happened

WatchGuard published CVE-2026-93857 on October 27, 2026, rated critical at CVSS 4.0 9.2: a stack-based buffer overflow vulnerability (CWE-120, CWE-121, CWE-787) in Fireware OS’s SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

WatchGuard’s record lists Fireware OS 2025.1 before 2026.4 and 12.0 before 12.12.4 as affected, and 12.0 before 12.5.22 on T15 and T35 appliances, making 2026.4, 12.12.4, and 12.5.22 the fixed releases for their branches.

What to do

  1. Inventory WatchGuard Firebox appliances and note the Fireware OS version and model of each.
  2. Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 (T15 and T35) or later, matching the branch in use.
  3. Until upgraded, restrict management interfaces, cluster interfaces, and proxied services to the smallest set of trusted networks possible.
  4. Review firewall logs for unusual traffic to the affected services, configuration changes, and new administrative accounts.
  5. Verify the running Fireware OS version after upgrading, including clustered pairs and standby units.

Management note

Firewalls are the perimeter and the prize. A batch of remotely reachable Fireware flaws should be patched as a single emergency change, with clustered and standby units explicitly counted, because the appliance everyone forgets is the one that gets used.