Act nowDisclosed

Advisory · CVE-2026-93865

Missing authentication in WatchGuard FireCluster sync lets a remote attacker invoke privileged actions

WatchGuard Fireware OS's FireCluster synchronization daemon contains a missing authentication flaw that allows a remote unauthenticated attacker to invoke privileged system-level administrative actions through the FireCluster management IP when clustering is enabled. CVSS 4.0 9.2.

Advisory published October 27, 2026Independent summary
Vendor
WatchGuard
Product
Fireware OS
Identifier / CWE
CVE-2026-93865
CWE-77, CWE-306, CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

The cluster channel that lets two firewalls act as one does not check who is calling. Anyone who can reach that channel can ask the firewall to perform privileged management actions, and it obeys.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Clustering enabled

    The firewall runs with the FireCluster feature enabled, exposing the synchronization daemon on the cluster management IP.

  2. 02Crafted request sent

    A remote unauthenticated attacker sends a specially crafted request to the FireCluster management IP.

  3. 03No authentication checked

    The synchronization daemon accepts the request without authenticating the caller.

  4. 04Privileged actions run

    The attacker invokes privileged system-level administrative actions on the firewall.

What happened

WatchGuard published CVE-2026-93865 on October 27, 2026, rated critical at CVSS 4.0 9.2: a missing authentication vulnerability (CWE-306) in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

WatchGuard’s record lists Fireware OS 2025.1 before 2026.4 and 12.0 before 12.12.4 as affected, and 12.0 before 12.5.22 on T15 and T35 appliances, making 2026.4, 12.12.4, and 12.5.22 the fixed releases for their branches.

What to do

  1. Inventory WatchGuard Firebox appliances and note the Fireware OS version and model of each.
  2. Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 (T15 and T35) or later, matching the branch in use.
  3. Until upgraded, restrict management interfaces, cluster interfaces, and proxied services to the smallest set of trusted networks possible.
  4. Review firewall logs for unusual traffic to the affected services, configuration changes, and new administrative accounts.
  5. Verify the running Fireware OS version after upgrading, including clustered pairs and standby units.

Management note

Firewalls are the perimeter and the prize. A batch of remotely reachable Fireware flaws should be patched as a single emergency change, with clustered and standby units explicitly counted, because the appliance everyone forgets is the one that gets used.