Act nowDisclosed

Advisory · CVE-2026-93866

Integer overflow in WatchGuard Fireware OS Access Portal WebSocket handling can execute code

WatchGuard Fireware OS contains an integer overflow in the WebSocket connection handling used by its Access Portal that allows a remote unauthenticated attacker to reach code execution. CVSS 4.0 9.2.

Advisory published October 27, 2026Independent summary
Vendor
WatchGuard
Product
Fireware OS
Identifier / CWE
CVE-2026-93866
CWE-190, CWE-288, CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

The portal that lets people sign in remotely miscounts a size in its WebSocket handling, so memory gets written in the wrong place. A remote stranger can use that miscount to take over the firewall service.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Access Portal reachable

    The firewall exposes the Access Portal's WebSocket connection handling.

  2. 02Crafted connection made

    A remote unauthenticated attacker opens a WebSocket connection crafted to trigger the integer overflow.

  3. 03Size calculation wraps

    The overflow produces an incorrect size, and subsequent handling writes out of bounds.

  4. 04Code execution follows

    Per WatchGuard's record, the flaw allows the attacker to execute code on the firewall.

What happened

WatchGuard published CVE-2026-93866 on October 27, 2026, rated critical at CVSS 4.0 9.2: an integer overflow vulnerability (CWE-190, CWE-787) in the WebSocket connection handling used by WatchGuard Fireware OS’s Access Portal allows a remote, unauthenticated attacker to execute arbitrary code.

WatchGuard’s record lists Fireware OS 2025.1 before 2026.4 and 12.0 before 12.12.4 as affected, and 12.0 before 12.5.22 on T15 and T35 appliances, making 2026.4, 12.12.4, and 12.5.22 the fixed releases for their branches.

What to do

  1. Inventory WatchGuard Firebox appliances and note the Fireware OS version and model of each.
  2. Upgrade to Fireware OS 2026.4, 12.12.4, or 12.5.22 (T15 and T35) or later, matching the branch in use.
  3. Until upgraded, restrict management interfaces, cluster interfaces, and proxied services to the smallest set of trusted networks possible.
  4. Review firewall logs for unusual traffic to the affected services, configuration changes, and new administrative accounts.
  5. Verify the running Fireware OS version after upgrading, including clustered pairs and standby units.

Management note

Firewalls are the perimeter and the prize. A batch of remotely reachable Fireware flaws should be patched as a single emergency change, with clustered and standby units explicitly counted, because the appliance everyone forgets is the one that gets used.