WatchGuard Fireware OS EUVD-2026-111146

Exploitation requires that the target run WatchGuard FireCluster (the high-availability clustering feature) and that the attacker be positioned on the cluster interconnect - either as a compromised cluster peer or an on-path/man-in-the-middle attacker on the sync network (consistent with AV:A, adjacent). The FireCluster Sync processing performs no authentication (CWE-290), so once that position is held, a single crafted request invokes root-level management actions without credentials or user interaction (PR:N/UI:N/AC:L). Limiting factors that reduce realistic risk: standalone (non-clustered) Fireboxes are not exposed via this path, and the cluster interconnect is typically a dedicated/isolated link, so the attacker must first obtain that adjacent network position. Complete fix is applying the vendor-updated Fireware OS (12.12.4, 2026.4, or 12.5.22 on the respective branches).

This is a genuine high-priority issue rather than a high-CVSS/low-real-risk case, though its exploitation is gated by network position. The input CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with high confidentiality, integrity and availability impact to both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), consistent with a missing-authentication flaw (CWE-290) that yields root-level firewall management control. The vuln.today decision label is act_now and the vendor (WatchGuard) both reported the flaw and shipped a patch, which reinforces urgency. However, several widespread-exploitation signals are absent: this CVE is NOT listed in CISA KEV, no EPSS score is provided in the input, and no PoC or exploit reference is present, so there is no public exploit identified at time of analysis. The key tension is that the raw 9.4 score reflects root-level impact, but the AV:A vector means the attacker must already hold a privileged network position on the cluster interconnect - so real-world risk concentrates on environments running FireCluster high-availability pairs where the sync link or a peer could be reached or compromised, rather than on broad internet-facing exposure. Treat as act_now for FireCluster deployments; verify FireCluster usage before deprioritizing.

An attacker who has compromised one node of a WatchGuard FireCluster high-availability pair, or who can intercept/inject traffic on the dedicated cluster interconnect link, sends a specially crafted FireCluster Sync request to a peer. Because the sync processing performs no authentication, the request is accepted and executes privileged firewall management actions as root. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or grooming is required once network position is obtained.