CVE-2026-104381: Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

Published Oct 27, 2026

Updated

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.22

Event History

Oct 27, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using FireCluster state synchronization are exposed if an attacker can access the cluster synchronization network segment. The described impact is premature termination of BOVPN tunnels.

What access does an attacker need to trigger the denial of service?

The attacker does not need to authenticate, but must be positioned on the cluster synchronization network segment and be able to send crafted cluster synchronization traffic.