WatchGuard Fireware OS CVE-2026-93865

Exploitation requires the FireCluster clustering feature to be ENABLED on the WatchGuard Fireware OS appliance, and the attacker must be able to send traffic to the FireCluster management IP - this is exactly the precondition reflected by AT:P in the CVSS 4.0 vector. When those conditions are met, no authentication is required (PR:N, CWE-306 missing authentication) and no user interaction is needed (UI:N), allowing invocation of privileged system-level administrative actions. Limiting factors: single-appliance deployments that do not run FireCluster are not exposed, and exploitation depends on network reachability of the FireCluster management IP, so segmenting or restricting access to that management interface materially reduces exposure. Affected versions per EUVD: Fireware OS 12.0 <12.12.4, 12.0 <12.5.22, and 2025.1 <2026.4; vendor patch is available and updating is the remediation path indicated.

This is a genuine high-priority issue, not a CVSS-inflated one. The signals align strongly: CVSS 4.0 base 9.2 with AV:N/PR:N/UI:N (network-reachable, unauthenticated, no user interaction) matches CWE-306 (Missing Authentication), and the vuln.today decision label is act_now with a vendor patch already available - all pointing to immediate remediation. The one metric that tempers raw severity is AT:P (attack requirement present), which reflects that exploitation depends on a specific deployment condition: the FireCluster clustering feature must be enabled and the attacker must be able to reach the FireCluster management IP. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the input, so there is currently no evidence of active exploitation or widespread weaponization - the urgency here is driven by the act_now decision label, the critical unauthenticated-admin impact, and patch availability rather than by observed in-the-wild activity. In short: treat as act_now for any deployment running FireCluster, but recognize the real-world exploitable population is bounded by how many appliances actually run clustering with a reachable management IP.

An attacker with network access to a WatchGuard appliance that has FireCluster enabled sends a specially crafted request directly to the FireCluster management IP, bypassing authentication entirely (CWE-306) to invoke privileged system-level administrative actions. Because AV:N/AC:L/PR:N/UI:N applies, no credentials or user interaction are needed once the management IP is reachable and clustering is active. No public exploit code was identified in the provided data.