CVE-2026-93865: Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

Published Oct 27, 2026

Updated

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.4
Upgrade
Upgrade Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.22

Event History

Oct 27, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

WatchGuard Fireware OS deployments are exposed when the FireCluster feature is enabled and the FireCluster management IP can receive attacker-supplied requests. The issue is in the FireCluster synchronization daemon.

What does an attacker need to exploit it?

An attacker does not need authentication. They need network access to send a specially crafted request to the FireCluster management IP.

What level of access can successful exploitation provide?

Successful exploitation allows invocation of privileged system-level administrative actions, effectively enabling remote root action injection.