Skip to main content

WatchGuard Fireware OS CVE-2026-8247

| EUVDEUVD-2026-41459 HIGH
Classic Buffer Overflow (CWE-120)
2026-07-02 WatchGuard GHSA-h2w9-p676-66ch
Watchguard Buffer Overflow RCE Fireware Os
7.7
CVSS 4.0 · Vendor: WatchGuard
Share

Severity by source

Vendor (WatchGuard) PRIMARY
7.7 HIGH
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

AV:A for same-segment adjacency; AC:H folds the CVSS 4.0 AT:P attack requirement into 3.1 complexity; PR:N/UI:N as unauthenticated with no interaction; C/I/A:H for full appliance code execution.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 02, 2026 - 23:51 vuln.today

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain foothold on adjacent LAN segment
Delivery
Send crafted traffic to Firebox service
Exploit
Trigger out-of-bounds write (CWE-120)
Execution
Corrupt memory and hijack control flow
Impact
Execute arbitrary code on appliance
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be on the same local/adjacent network segment as the WatchGuard Firebox (CVSS AV:A) - it is NOT exploitable from the internet without first obtaining a LAN foothold. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score is 7.7 (High) with vector AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has gained a foothold on the internal network - via a compromised workstation, a rogue device plugged into an office jack, or a malicious VM on the same segment - sends specially crafted traffic to the WatchGuard Firebox to trigger the out-of-bounds write in a network-facing service. By overflowing the fixed-size buffer, the attacker corrupts memory to hijack control flow and executes arbitrary code on the firewall itself, without any credentials or user interaction. …
Remediation Patch available per vendor advisory: consult the WatchGuard PSIRT advisory WGSA-2026-00026 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00026) and upgrade Fireware OS to the fixed release for your branch - a specific fixed version is not stated in the available data and must be confirmed from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Conduct inventory of all WatchGuard Firebox appliances and current firmware versions; restrict administrative access to affected firewalls to trusted networks only; implement network segmentation to minimize adjacent-segment connectivity to firewall devices. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Watchguard

View all
CVE-2015-5453 MEDIUM POC
6.5 Jul 08

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
CVE-2015-5452 HIGH POC
7.5 Jul 08

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
CVE-2022-26318 CRITICAL POC
9.8 Mar 04

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
CVE-2018-10575 CRITICAL POC
9.8 Apr 30

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
CVE-2018-10577 HIGH POC
8.8 May 02

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
CVE-2016-7089 HIGH POC
7.8 Aug 24

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
CVE-2018-10576 HIGH POC
7.8 Apr 30

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
CVE-2017-14616 HIGH POC
7.5 Sep 20

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability

CVE-2017-8056 MEDIUM POC
5.3 Apr 22

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
CVE-2022-31790 HIGH POC
7.5 Sep 06

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
CVE-2020-10532 HIGH POC
7.5 Mar 12

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext password
CVE-2017-14615 MEDIUM POC
6.1 Sep 20

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8
CVE-2012-2763 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-8247 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy