EUVD-2026-41462
GHSA-j5qg-7rp2-rw7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Management Web UI with no user interaction, but requires privileged admin access (PR:H); full code execution yields high C/I/A with no scope change.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.This vulnerability affects Fireware OS 11.8 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
AnalysisAI
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allows an authenticated privileged administrator to run arbitrary code on the firewall by sending specially crafted requests to the Management Web UI, which trigger an out-of-bounds write in the networkd process. The flaw spans a wide version range (11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2) and carries a CVSS 4.0 base score of 8.6 (High). It was reported by WatchGuard's own PSIRT; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Fireware OS is WatchGuard's proprietary firmware for its Firebox line of firewall/UTM appliances; the affected component is networkd, a privileged system daemon responsible for network configuration and management functions that is reachable through the appliance's HTTPS Management Web UI. The root cause is CWE-787 (Out-of-bounds Write): input from a crafted management request is written past the bounds of an allocated buffer, corrupting adjacent memory. Because networkd runs with elevated privileges on the appliance, controlled memory corruption there can be steered into arbitrary code execution in the firewall's control plane. The CPE cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* confirms Fireware OS itself as the affected software, with the specific vulnerable ranges enumerated in the advisory rather than in the CPE wildcard.
RemediationAI
Consult WatchGuard PSIRT advisory WGSA-2026-00029 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00029) and upgrade Fireware OS to the fixed release identified there for your branch; the input data does not include an exact fixed version number, so the specific target build must be taken from the advisory and not invented. As a compensating control until patched, restrict access to the Management Web UI: bind management to a dedicated trusted management interface or VLAN, block management ports from untrusted and WAN-facing networks, and limit administrative access to a small set of known source addresses - this reduces who can reach the vulnerable networkd endpoint, at the cost of constraining remote management workflows. Because exploitation requires privileged credentials, also rotate and tightly scope administrator accounts, enforce MFA on admin logins, and audit admin activity; these controls limit legitimate admin convenience and do not remove the underlying flaw, so patching remains the primary fix.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially cra
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today