WatchGuard Fireware OS: Heap buffer overflow in AD authentication service
Summary
A heap-based buffer overflow in the Fireware OS authentication service affects Firebox firewalls configured with an Active Directory authentication server. An attacker who controls or intercepts traffic to the configured AD server can send a specially crafted response to cause a denial of service and potentially execute arbitrary code. The vendor states that no login is required, but the attacker must be able to control or intercept AD traffic.
Affected
- Fireware OS 2025.1 to before 2026.4 (default)
- Fireware OS 12.0 to before 12.12.4 (default)
- T15/T35: Fireware OS 12.0 to before 12.5.22
- Only Firebox deployments configured with an Active Directory authentication server
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
- Exact build numbers: see the WatchGuard PSIRT page or download centre. Unknown in this note.
Workaround
- No vendor-documented workaround. Unknown.
- Check whether AD authentication is configured on each Firebox; devices without it are not affected.
- Interim measure (not vendor-confirmed): restrict which systems can reach the AD server path.
Exploitation
- WatchGuard is not aware of any exploitation in the wild.
- Not listed in CISA KEV at the time of the sources.
- No public proof-of-concept confirmed (VulDB, Securityonline).
- Status may change quickly as this is a fresh disclosure.
Our recommendation
- Inventory all Fireboxes and check whether Active Directory authentication is configured.
- Schedule the upgrade to the fixed versions (2026.4, 12.12.4, or 12.5.22 for T15/T35), starting with internet-facing devices.
- Restrict network access to the AD server path as an interim measure.
- Re-check CISA KEV and vendor advisories weekly, as earlier WatchGuard flaws have been exploited.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-112710 psirt.watchguard.com
- WatchGuard blog: Immediate action required, update your Firebox now www.watchguard.com
- Securityonline: WatchGuard Fireware OS vulnerabilities securityonline.info
- CyberSecurityNews: WatchGuard discloses critical firewall flaws cybersecuritynews.com
- VulDB entry 427419 vuldb.com
- OffSeq radar CVE-2026-112710 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:00.
Original description (NVD)
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.