CVE-2026-103594: Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 2026.4 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.12.4
Event History
Frequently Asked Questions
What access must an attacker have to exploit this issue?
The attacker needs man-in-the-middle access that allows them to decrypt TLS traffic between a Firebox and WatchGuard Cloud. They must then tamper with a FireCloud Gateway configuration payload.
Which deployments are exposed?
Exposure is limited to Fireware OS devices that process WireGuard configuration through the Firebox-to-WatchGuard Cloud connection and where an attacker can obtain TLS-decrypted man-in-the-middle access on that path. The provided information does not identify affected versions or whether this configuration is enabled by default.
What is the potential impact of successful exploitation?
A successful attack can cause a denial-of-service condition and may allow arbitrary code execution on the affected Fireware OS device.