CVE-2026-103593: Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

Published Oct 27, 2026

Updated

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.22

Event History

Oct 27, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

RemedyDescriptionWeakness

Frequently Asked Questions

What network position does an attacker need to exploit this issue?

The attacker must be network-adjacent and able to impersonate the configured log server or intercept traffic sent to it. Exploitation is performed by presenting a specially crafted certificate.

What level of access could successful exploitation provide?

Successful exploitation can allow arbitrary code execution with root privileges on the affected Fireware OS device.