CVE-2026-93862: Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

Published Oct 27, 2026

Updated

An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.22

Event History

Oct 27, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments should be prioritized for triage?

Prioritize WatchGuard Fireware OS deployments that use FireCluster synchronization and have a cluster interconnect accessible to a cluster peer or an on-path attacker. The stated impact is repeated crashes of the cluster synchronization process, causing sustained denial of service.

Does the available advisory information identify affected or fixed Fireware OS versions?

No. The provided information identifies WatchGuard Fireware OS but does not list affected versions, fixed versions, or patch availability.