CVE-2026-93866: Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

Published Oct 27, 2026

Updated

An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.4
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.4
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.22

Event History

Oct 27, 2026

CVE Published

via MITRE·03:52 PM

Data Sourced

via MITRE·03:52 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

WatchGuard Fireware OS deployments are exposed when the Access Portal feature is enabled. The vulnerability is in WebSocket connection handling used by that feature.

Does exploitation require authentication or prior access?

No. A remote attacker can exploit the issue without authentication by sending a specially crafted request.

How can I determine whether my environment is potentially affected?

Verify whether the system runs WatchGuard Fireware OS and whether Access Portal is enabled. The provided information does not identify affected versions or a fixed release.