Which versions of WatchGuard Fireware OS are affected by CVE-2026-8247?

WatchGuard Fireware OS across multiple versions (11.0-2026.2) contains a remote code execution vulnerability exposing firewall appliances to compromise by unauthenticated attackers on the adjacent…

How to fix or mitigate CVE-2026-8247?

Within 24 hours: Conduct inventory of all WatchGuard Firebox appliances and current firmware versions; restrict administrative access to affected firewalls to trusted networks only; implement network segmentation to minimize adjacent-segment connectivity to firewall devices. Within 7 days: Deploy network-based intrusion detection/prevention rules targeting CVE-2026-8247; establish daily monitoring of WatchGuard PSIRT advisories for patch releases; review firewall logs and system events for indicators of compromise. Within 30 days: Apply WatchGuard firmware patch to all affected Firebox appliances immediately upon vendor release; if no patch is available, evaluate firewall replacement or escalate to WatchGuard enterprise support for specialized mitigation.

WatchGuard Fireware OS CVE-2026-8247

Q: What is the CVSS score of CVE-2026-8247?

CVE-2026-8247 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41459 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 WatchGuard

GHSA-h2w9-p676-66ch

Watchguard Buffer Overflow RCE Fireware Os

7.7

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

7.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AV:A for same-segment adjacency; AC:H folds the CVSS 4.0 AT:P attack requirement into 3.1 complexity; PR:N/UI:N as unauthenticated with no interaction; C/I/A:H for full appliance code execution.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:51 vuln.today

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, unauthenticated, high-impact profile makes it a serious perimeter-device concern.

Technical ContextAI

Fireware OS is the embedded operating system running on WatchGuard Firebox network security appliances (firewalls/UTM gateways). The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input, the classic buffer overflow) manifesting as an out-of-bounds write: a service or parser processing adjacent-network traffic copies attacker-influenced data into a fixed-size buffer without adequate bounds checking, corrupting adjacent memory. Because Firebox devices terminate and inspect traffic at the network edge, memory corruption in a network-facing daemon can be steered into control-flow hijack and native code execution on the appliance. The CPE cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* confirms Fireware OS itself as the vulnerable component across all listed version branches; the specific vulnerable service or protocol is not disclosed in the advisory summary.

RemediationAI

Patch available per vendor advisory: consult the WatchGuard PSIRT advisory WGSA-2026-00026 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00026) and upgrade Fireware OS to the fixed release for your branch - a specific fixed version is not stated in the available data and must be confirmed from that advisory before deployment. Because exploitation requires adjacency (same local network segment), the strongest compensating control while patching is to restrict which hosts and VLANs can reach the Firebox's local-segment attack surface: place management and inter-appliance interfaces on a dedicated, tightly segmented VLAN, and enforce port security/802.1X to keep rogue devices off the segment (trade-off: added network-admin overhead and potential access disruption if 802.1X is misconfigured). Additionally limit which internal hosts share a broadcast domain with the firewall and monitor for unexpected devices on management segments. These controls reduce but do not eliminate risk from an already-compromised internal host, so patching remains the priority.