WatchGuard Fireware OS CVE-2026-104381

Exploitation requires the FireCluster high-availability clustering feature to be enabled and the attacker to be positioned on the cluster state-synchronization network segment (AV:A adjacent, with AT:P indicating a specific attack requirement). No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attacker must be able to inject crafted synchronization traffic onto that segment. The principal limiting factor is network segmentation: FireCluster sync links are typically deployed on a dedicated, isolated interface/VLAN, so a properly segregated sync network prevents an external or general-LAN attacker from reaching it. Impact is limited to forced VPN tunnel termination (availability), not compromise of confidentiality or full integrity.

This is a medium-severity, situationally-constrained availability issue rather than a high-urgency emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H) scores 6.0 and the signals are internally consistent: exploitation is unauthenticated (PR:N) but requires an adjacent position (AV:A) on the cluster synchronization segment plus a specific attack requirement (AT:P), which materially limits reach. Impact is skewed to availability (VA:H - forced VPN tunnel termination) with only low integrity impact and no confidentiality impact, so this is a disruption/DoS-class flaw, not a code-execution or data-exposure flaw. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-assigned priority is 'this_month', aligning with a patch-on-normal-cadence posture rather than immediate action. The main caveat: AT:P and AV:A mean an attacker must already be on the normally-isolated FireCluster sync network, so real-world exploitability hinges on whether that segment is properly segregated - a correctly deployed dedicated sync link sharply reduces practical risk.

An attacker who has gained a foothold on the dedicated FireCluster state-synchronization network segment sends crafted, unauthenticated cluster synchronization traffic to a Fireware OS cluster member. Because the sync feature does not authenticate this traffic (CWE-294), the attacker can force premature termination of active VPN tunnels, disrupting remote-access and site-to-site connectivity. No public exploit has been identified at time of analysis, and success depends on the attacker first reaching the adjacent sync segment.