WatchGuard Fireware OS: Missing authentication in FireCluster Sync
Summary
A missing authentication flaw in the FireCluster Sync processing of WatchGuard Fireware OS lets an attacker on the cluster interconnect invoke privileged firewall management actions as root with a specially crafted request. The attacker must be positioned on the cluster interconnect, for example as a compromised cluster peer or an on-path network attacker, so internet exposure is not the primary risk. Severity ratings differ between sources (vendor: 8.7 High; an aggregator: 9.4 Critical), so verify the score against the vendor advisory before reporting it.
Affected
- Fireware OS default product line: 2025.1 to before 2026.4, and 12.0 to before 12.12.4
- Fireware OS T15/T35: 12.0 to before 12.5.22
- Only Firebox appliances configured as a member of a FireCluster are affected.
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
Workaround
- Unknown. WatchGuard has published no CVE-specific workaround. Patching is the remedy.
- A secondary source recommends isolating FireCluster links as a general measure.
Exploitation
- WatchGuard is not aware of any exploitation of this vulnerability in the wild.
- VulDB: no exploit is available.
- OffSeq: not known to be exploited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all Firebox appliances configured as FireCluster members.
- Confirm the firmware version and upgrade to 2026.4, 12.12.4 or 12.5.22 (T15/T35) in the next maintenance window.
- Restrict cluster sync and management networks to dedicated, isolated segments.
- Check that the FireCluster management interface is not reachable from untrusted networks, because the companion flaw CVE-2026-93865 is remotely reachable and fixed in the same releases.
- Monitor the vendor advisory for updates on exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-90465 psirt.watchguard.com
- VulDB CVE-2026-90465 vuldb.com
- OffSeq threat radar CVE-2026-90465 radar.offseq.com
- Strix CVE-2026-90465 (aggregator) www.strix.ai
- WatchGuard PSIRT companion advisory CVE-2026-93865 psirt.watchguard.com
- SecurityOnline WatchGuard Fireware OS batch overview securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:43.
Original description (NVD)
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.