CVE-2026-112709 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An attacker who can control or intercept traffic to the configured Active Directory server can exploit this flaw by returning a specially crafted response, potentially causing denial of service or arbitrary code execution. The vulnerability has a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability. Fixed versions are available starting from 2026.4, 12.12.4, and 12.5.22 respectively.
CVE-2026-90464 is a high-severity vulnerability in WatchGuard Fireware OS that allows a remote, authenticated attacker with read-only Device Monitor privileges and CLI access to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges via a specially crafted diagnostic command. The vulnerability involves external control of file paths in a firewall diagnostic command. The issue is fixed in Fireware OS versions 2026.4, 12.12.4, and 12.5.22.
CVE-2026-103593 is a critical stack-based buffer overflow vulnerability in the WatchGuard Fireware OS logging service. It allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS 4.0 score of 9.1 reflects the potential for remote code execution without user interaction or privileges.
CVE-2026-113881 is a stack-based buffer overflow vulnerability in WatchGuard Fireware OS affecting the VPN Network Access Enforcement process. An authenticated mobile VPN user can exploit this flaw by sending a specially crafted request, causing a denial of service and potentially executing arbitrary code as an unprivileged process. The vulnerability affects Fireware OS versions from 2025.1 up to but not including 2026.4, and versions from 12.9 up to but not including 12.12.4. A fix is available in versions 2026.4 and 12.12.4. The CVSS 4.0 base score is 6.1, indicating medium severity.
CVE-2026-93434 is an XPath injection vulnerability in WatchGuard Fireware OS affecting the SSH authentication process. It allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting specially crafted requests. The vulnerability affects multiple versions prior to 12.5.22, 2026.4, and 12.12.4. It has a high severity score of 8.7 and has been officially fixed in the specified versions.
CVE-2026-90442 is a stack-based buffer overflow vulnerability in the certd process of WatchGuard Fireware OS. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An authenticated attacker with access to the Firebox management interface can exploit this flaw by sending a specially crafted request, causing the certificate management service to crash and potentially allowing arbitrary code execution. The vulnerability has a high severity with a CVSS 4.0 score of 8.6. Fixed versions are 2026.4, 12.12.4, and 12.5.22.
CVE-2026-112710 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An attacker who can control or intercept traffic to the configured Active Directory server can exploit this flaw by sending a specially crafted response, potentially causing denial of service or arbitrary code execution. The vulnerability has a CVSS 4.0 base score of 9.2, indicating high impact on confidentiality, integrity, and availability. Fixed versions are available in 2026.4, 12.12.4, and 12.5.22.
CVE-2026-82332 is an improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process. It allows a local, unauthenticated attacker on the appliance to hijack another user's active MFA session by sending a specially crafted request and tricking the victim into accepting an MFA push notification. The vulnerability affects Fireware OS versions from 2025.1 up to but not including 2026.4, and versions from 12.7 up to but not including 12.12.4. A fix is available in versions 2026.4 and 12.12.4. The CVSS 4.0 base score is 5.6, indicating medium severity.
CVE-2026-93857 is a critical stack-based buffer overflow vulnerability in WatchGuard Fireware OS's SIP proxy. It allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS 4.0 score of 9.2 reflects the ease of exploitation and potential impact. Fixed versions are available, and users should upgrade to mitigate this risk.
CVE-2026-93866 is a critical integer overflow vulnerability in the WebSocket connection handling of WatchGuard Fireware OS's Access Portal. It allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request when the Access Portal feature is enabled. This vulnerability affects multiple versions of Fireware OS prior to fixed releases.
CVE-2026-93864 is a path traversal vulnerability in WatchGuard Fireware OS's firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges by planting a crafted file system object and triggering a list update. This can also lead to tampering with firewall IP set data. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity rating with a CVSS score of 7.1. Fixed versions are available.
CVE-2026-103594 is a critical stack-based buffer overflow vulnerability in WatchGuard Fireware OS affecting the WireGuard configuration processing. A remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud can exploit this flaw to cause a denial of service or potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload. The vulnerability affects Fireware OS versions from 2026.2 up to but not including 2026.4, and versions from 12.12 up to but not including 12.12.4. Fixed versions are 2026.4 and 12.12.4.
CVE-2026-104381 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster state synchronization feature. An unauthenticated attacker on the cluster synchronization network segment can send crafted traffic to prematurely terminate VPN tunnels. The issue affects multiple versions prior to fixed releases 2026.4, 12.12.4, and 12.5.22. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6. No known exploits are reported in the wild.
CVE-2026-111107 is a high-severity vulnerability in WatchGuard Fireware OS management interface that allows remote unauthenticated attackers to crash the management service via a specially crafted login request. This causes a NULL pointer dereference, terminating all active administrator sessions and ongoing management operations. The vulnerability does not affect traffic processing through the device. Fixed versions are available.
CVE-2026-93865 is a critical vulnerability in WatchGuard Fireware OS affecting the FireCluster synchronization daemon. It allows a remote, unauthenticated attacker to perform privileged system-level administrative actions by sending specially crafted requests to the FireCluster management IP when clustering is enabled. The flaw is due to missing authentication for a critical function. Fixed versions are available.
The npm package 'string-target-mapper-hash' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The npm package 'macro-kernel-record-reader' is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate rotation of all secrets and keys stored on the affected system is recommended, using a different, uncompromised machine. Removal of the package is advised, but it may not fully eliminate the malicious presence due to possible persistent backdoors or additional malware installed.
The npm package 'fetch-hash-cache-atomic' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removal of the package alone is insufficient to guarantee the elimination of all malicious software introduced by this package.
CVE-2026-109823 is a vulnerability in tidewave versions from 0.8.0 up to but not including 0.9.2 that allows an attacker to read filesystem path names exposed via Tidewave configuration endpoints and the rendered toolbar. The issue arises because responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. This exposure can reveal local usernames and project layout details.
CVE-2026-117510 is a path traversal vulnerability in Dexmal Dexbotic versions 0.1 and 0.2.0. It affects the load_pretrained_gr00t function in the gr00tsonic Checkpoint Loader component. The flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been published, but no vendor response or patch is currently available.