CVE-2026-90465: Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fireware OSto a version that resolves this vulnerability.Fixed in 2026.4 - Upgrade
Upgrade
Fireware OSto a version that resolves this vulnerability.Fixed in 12.12.4 - Upgrade
Upgrade
Fireware OSto a version that resolves this vulnerability.Fixed in 12.5.22
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Fireware OS deployments using FireCluster Sync are exposed if an attacker can access or intercept traffic on the cluster interconnect. The described attacker positions include a compromised cluster peer or an on-path network attacker.
What access does an attacker need?
The attacker must be positioned on the cluster interconnect and able to send a specially crafted request to FireCluster Sync processing. The available information does not indicate that exposure through a general management interface or the public internet alone is sufficient.
What is the impact if exploitation succeeds?
An attacker can invoke privileged firewall management actions as root. This can give the attacker root-level control over affected firewall management functions.
What can be done while patching is not immediately possible?
Restrict access to the cluster interconnect to trusted cluster peers and reduce the opportunity for on-path interception or injection. Investigate and remediate any suspected compromised cluster peer, since a compromised peer is identified as a viable attacker position.