WatchGuard Fireware OS CVE-2026-113881

Exploitation requires the WatchGuard Mobile VPN feature to be in use and the attacker to be an authenticated mobile VPN user (PR:L), reaching the VPN Network Access Enforcement process with a specially crafted request; the 4.0 vector's AT:P indicates an additional attack-specific requirement must also be satisfied for the trigger to succeed. Limiting factors: valid VPN authentication is mandatory (no anonymous exploitation), the device must have mobile VPN configured, and the code-execution outcome is only 'potential' and confined to an unprivileged process; the primary guaranteed outcome is a denial of service. The exact nature of the triggering request and the AT:P condition are not detailed in the available sources.

This is a moderate, not emergency-tier, priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 6.1 and shows the weakness is reachable over the network but NOT by an anonymous attacker: PR:L confirms the attacker must already be an authenticated mobile VPN user, and AT:P indicates a specific attack requirement must be met for the trigger to succeed. Impact is bounded - VA:H reflects the clearly-described denial of service, while VC:L/VI:L reflect only the 'potentially execute arbitrary code as an unprivileged process' outcome, which is explicitly unprivileged rather than root/kernel. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch being available and no active-exploitation signal. There is no CISA KEV listing and no EPSS value supplied, so exploitation probability cannot be quantified from this data; there is also no PoC or exploit reference in the input. The main tension is between the sensational tags ('RCE') and the actual metrics: the code-execution path is only 'potential' and unprivileged, and it requires prior VPN authentication, so this should be treated as an authenticated DoS with a possible limited code-execution upside - real but lower-urgency than an unauthenticated RCE. Confirm EPSS/KEV independently before deprioritizing, since both are simply absent here rather than confirmed-negative.

An attacker who already holds valid mobile VPN credentials (or has compromised a legitimate VPN user's account) connects to a WatchGuard firewall and sends a specially crafted request to the VPN Network Access Enforcement process, overflowing a stack buffer. This reliably crashes the process to cause a denial of service and may allow execution of attacker-controlled code as an unprivileged process. No public exploit code or PoC reference is present in the available data.