WatchGuard Fireware OS CVE-2026-103594

Exploitation requires the attacker to hold a man-in-the-middle position with TLS-decrypted visibility into the communication channel between the Firebox and WatchGuard Cloud, and then to tamper with a FireCloud Gateway configuration payload that is parsed by Fireware OS's WireGuard configuration processing. The decisive limiting factor is this TLS-decryption/MITM prerequisite - the attacker must already be able to intercept and decrypt the device-to-cloud session (reflected in CVSS 4.0 as AT:P), which excludes casual remote attackers and confines realistic exploitation to adversaries with privileged network positioning or compromised trust in that channel. Affected only on Fireware OS 12.12 before 12.12.4 and 2026.2 before 2026.4; other versions are not listed as vulnerable.

Signals conflict in a way that matters for prioritization. The vendor-supplied CVSS 4.0 base score is 9.5 (Critical) with VC/VI/VA:H and subsequent-system SC/SI/SA:H, and the vuln.today decision label is act_now - both pushing urgency. However, the attack vector is heavily gated: the CVSS vector itself encodes AT:P (Attack Requirements: Present), reflecting the description's hard prerequisite that the attacker already hold a man-in-the-middle position capable of TLS-decrypting traffic between the Firebox and WatchGuard Cloud. That is a demanding precondition, so despite AV:N/PR:N (network, no authentication in CVSS terms) this is not trivially remotely exploitable against arbitrary internet-facing targets. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: treat as a high-priority patch (act_now, patch available) because the impact is severe and a patch exists, but recognize the real-world exploitability is constrained to attackers who can already break the device-to-cloud TLS channel - closer to a targeted/positioned-adversary scenario than opportunistic mass exploitation.

An attacker who has established a man-in-the-middle position and can decrypt the TLS channel between a Firebox and WatchGuard Cloud intercepts and alters a FireCloud Gateway configuration payload, inserting malformed data that overflows a stack buffer in Fireware OS's WireGuard configuration processing. This crashes the device (Denial of Service) and may allow arbitrary code execution. No public exploit code or PoC reference is present in the supplied data.