WatchGuard Fireware OS EUVD-2026-111147

Exploitation requires that the target run in a FireCluster high-availability configuration AND that the attacker already hold a position on the cluster interconnect - specifically a compromised cluster peer or an on-path (man-in-the-middle) attacker on the interconnect link. From that position, crafted FireCluster synchronization traffic triggers the out-of-bounds read; no authentication is required (PR:N) and no user interaction is needed (UI:N). The principal limiting factor is the AV:A adjacency requirement: the cluster sync link is normally a dedicated, physically or logically isolated interface, so a stand-alone (non-clustered) Firebox or a properly segmented interconnect is not reachable by a remote internet attacker. The confirmed affected products are WatchGuard Fireware OS versions below 12.12.4, below 12.5.22 (12.0 LTS branch), and the 2025.1 branch below 2026.4.

The CVSS 4.0 base score of 7.2 (HIGH) is driven by VA:H (availability impact high), with only VC:L/VI:L and no subsequent-system impact, so this is fundamentally a denial-of-service issue rather than a code-execution or data-theft flaw. The single most important mitigating signal is AV:A: the attacker must be adjacent on the FireCluster interconnect, not on the open internet, which materially narrows real-world exposure compared to a true AV:N network bug. Exploitation is unauthenticated (PR:N), low-complexity (AC:L) and needs no special attack requirement (AT:N) or user interaction (UI:N), so anyone who already holds that interconnect position can trigger it reliably. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no PoC or exploit reference is present, so there is no public exploit identified at time of analysis and no evidence of active exploitation - these signals are absent rather than conflicting. The vendor-priority Decision label is 'this_week' (not act_now/emergency), consistent with: real but conditional risk, a patch already available, and a constrained attack surface. Net assessment: patch within the normal maintenance window this week; this is a credible availability threat to HA pairs but not an internet-facing emergency, and well-segmented deployments with an isolated cluster link face low practical risk.

An attacker who has compromised one firewall in a WatchGuard FireCluster HA pair, or who gains an on-path position on the dedicated cluster interconnect link, sends specially crafted FireCluster synchronization traffic to the peer. The malformed traffic triggers an out-of-bounds read (CWE-125) that repeatedly crashes the cluster synchronization process, causing a sustained denial of service against the clustered firewalls. No public exploit identified at time of analysis.