CVE-2026-93864: Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
Published Oct 27, 2026
·Updated
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Oct 27, 2026
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need before exploiting this issue?
The attacker must already have local code execution as a low-privileged system process. The available information does not identify a remote exploitation path.
2
What action is needed to trigger the vulnerability?
The attacker must plant a crafted file system object and trigger a list update in the firewall daemon.
3
Are overwritten file contents completely attacker-controlled?
No. The vulnerability can lead to arbitrary file overwrite as root, but the written content is described as partially constrained.