WatchGuard Fireware OS: Stack buffer overflow in SIP proxy allows remote code execution
Summary
A stack-based buffer overflow in the SIP proxy of WatchGuard Fireware OS, which runs on Firebox firewalls, allows a remote, unauthenticated attacker to execute arbitrary code. The attacker only needs to send a specially crafted request through a firewall policy that uses the SIP proxy. Only devices with a SIP proxy configured are affected.
Affected
- Fireware OS default: 2025.1 to before 2026.4, and 12.0 to before 12.12.4
- T15/T35: 12.0 to before 12.5.22
- Configurations without a SIP proxy are not exposed according to the vendor.
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
Workaround
Unknown. The vendor advisory does not document a workaround. Unverified analyst inference: if patching must wait, disabling or removing unused SIP proxy policies should reduce exposure, but this must be confirmed with WatchGuard.
Exploitation
- WatchGuard is not aware of any exploitation in the wild.
- Not listed as known-exploited in the sources checked (Strix shows KEV: No).
- VulDB reports no exploit available.
- A Sploitus entry labelled PoC is unverified and not evidence of a working exploit.
Our recommendation
- Inventory all Firebox devices and their Fireware OS versions.
- Patch to 2026.4 or 12.12.4, or 12.5.22 for T15/T35, with high priority.
- Check for SIP proxy policies and remove any that are unused.
- Review logs for unusual SIP traffic and check exposed devices for signs of compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-93857 psirt.watchguard.com
- VulDB entry CVE-2026-93857 vuldb.com
- Cybersecurity News: WatchGuard discloses critical firewall flaws cybersecuritynews.com
- Strix CVE-2026-93857 www.strix.ai
- OffSeq Radar CVE-2026-93857 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:57.
Original description (NVD)
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.