WatchGuard Fireware OS: NULL pointer dereference in management interface
Summary
A NULL pointer dereference in the management interface of WatchGuard Fireware OS lets a remote, unauthenticated attacker with network access to that interface crash the management service with a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected, so the impact is limited to availability of administration.
Affected
- WatchGuard Fireware OS default branch: 2025.1 to before 2026.4, and 12.0 to before 12.12.4
- WatchGuard Fireware OS on T15/T35 models: 12.0 to before 12.5.22
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
- Unknown whether 2025.x devices must move to 2026.4; the advisory lists no separate fix for that line.
Workaround
Unknown. The vendor advisory lists no CVE-specific workaround. General advice from a third-party roundup: restrict access to the management Web UI to trusted networks until patched.
Exploitation
- WatchGuard is not aware of any exploitation of this vulnerability in the wild.
- OffSeq lists it as not known to be exploited.
- No public proof-of-concept found; status should be re-checked.
- Not listed in CISA KEV.
Our recommendation
- Inventory all Fireboxes and their Fireware branch and version.
- Confirm that the management interface is not reachable from the internet and is limited to a management VLAN or VPN.
- Schedule the update to the fixed release for your branch; confirm the upgrade path for 2025.x devices with WatchGuard first.
- Review the other issues in the same WatchGuard advisory batch when patching.
- Monitor for management service outages and unexpected administrator session terminations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-111107 psirt.watchguard.com
- Belgian CCB advisory on WatchGuard Fireware OS vulnerabilities ccb.belgium.be
- OffSeq threat radar CVE-2026-111107 radar.offseq.com
- Strix CVE-2026-111107 www.strix.ai
- threatint CVE-2026-111107 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:55.
Original description (NVD)
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.