WatchGuard Fireware OS CVE-2026-90442

Exploitation requires the attacker to already hold authenticated, high-privilege access to the WatchGuard Firebox management interface (CVSS PR:H) and network reachability to the certd certificate management service, to which they send a specially crafted request that overflows a stack buffer. The principal limiting factors are: (1) prior high-privilege authentication to the management plane, which is normally restricted and should not be exposed to the public internet; and (2) the affected Fireware OS version - appliances already updated to 12.12.4, 2026.4, or 12.5.22 are fixed. Reliable arbitrary code execution is described by the vendor only as a potential outcome; a denial of service (certd crash) is the confirmed effect. The precise structure of the crafted request that triggers the overflow is not described in the available sources.

This is a genuinely serious but access-gated issue, and the signals are mostly consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 (High), driven by network reachability, low attack complexity, no user interaction, and full high impact to confidentiality, integrity and availability of the vulnerable certd process - but it explicitly requires PR:H, meaning the attacker must already be authenticated to the Firebox management interface with high privileges. That single factor is what separates this from a wormable perimeter catastrophe: it is not remote-unauthenticated. No EPSS score is provided, there is no CISA KEV listing, and no PoC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a patched, high-severity, privilege-gated flaw rather than an actively exploited one. Net assessment: a real priority to patch promptly given it is a firewall appliance and achieving code execution on a security gateway is high-value, but the PR:H prerequisite materially lowers mass-exploitation likelihood compared to the raw 8.6 score. Note the subsequent-system impacts are only Low (SC:L/SI:L/SA:L), indicating limited scope spill beyond the certd service itself.

An attacker who has already obtained authenticated high-privilege access to a Firebox management interface (e.g., via stolen admin credentials or an insider) sends a specially crafted request to the certd certificate management service, overflowing a stack buffer (CWE-121). Because attack complexity is low and no user interaction is needed, this reliably crashes certd and may allow arbitrary code execution on the appliance. No public exploit was identified at time of analysis.