WatchGuard Fireware OS: Missing authentication in FireCluster sync daemon
Summary
A missing authentication flaw in the FireCluster synchronization daemon of Fireware OS, the operating system of WatchGuard Firebox firewalls, allows a remote, unauthenticated attacker to trigger privileged system-level administrative actions. The attacker needs only to send a specially crafted request to the FireCluster management IP. The flaw applies only when the Firebox is configured as a member of a FireCluster; standalone units are not listed as affected.
Affected
- Fireware OS 2025.1 to before 2026.4 (default configuration)
- Fireware OS 12.0 to before 12.12.4 (default configuration)
- T15/T35: Fireware OS 12.0 to before 12.5.22
- Only Firebox appliances configured as a FireCluster member
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
Workaround
Unknown.
- No vendor-documented workaround identified.
- Interim measure (not vendor-confirmed): restrict network access to the FireCluster management IP and the cluster sync network to known administrator and cluster-peer hosts only, and do not expose them to the internet.
Exploitation
- WatchGuard is not aware of any exploitation of this vulnerability in the wild.
- No public exploit code or proof-of-concept has been confirmed at the time of research.
- Secondary sources report it is not in CISA KEV; CISA was not checked directly.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Identify all Firebox units operating in FireCluster mode and their Fireware OS versions.
- Upgrade to 2026.4, 12.12.4, or 12.5.22 (T15/T35), depending on model and release line.
- Until patched, confirm that the cluster management and sync interfaces are not reachable from the internet or untrusted networks.
- Monitor the vendor advisory, NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-93865 psirt.watchguard.com
- OffSeq threat radar CVE-2026-93865 radar.offseq.com
- Strix CVE-2026-93865 www.strix.ai
- SecurityOnline: WatchGuard Fireware OS vulnerabilities securityonline.info
- Cybersecurity News: WatchGuard discloses critical firewall flaws cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:58.
Original description (NVD)
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.