WatchGuard Fireware OS EUVD-2026-111148

The appliance must be configured to use an Active Directory authentication server, and the attacker must control or intercept traffic to that configured AD server (an adversary-in-the-middle position, or control of the AD server itself) - this is the AT:P attack requirement and is the primary limiting factor. Given that precondition, no valid Firebox credentials are required (CVSS PR:N), there is no user interaction (UI:N), and the trigger is a specially crafted AD authentication response that overflows a heap buffer in the Fireware OS authentication service. Exploitation is limited to deployments using AD-backed authentication and to attackers able to reach or tamper with the Firebox-to-AD traffic path; appliances not configured for AD authentication, or where that path cannot be intercepted, are not exposed.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk inflation. The CVSS 4.0 base score is 9.2 (Critical) with AV:N, AC:L, PR:N and UI:N, and the vuln.today Decision label is act_now, which combined with a vendor-confirmed patch argues for prompt remediation. The single most important modifier is AT:P (Attack Requirements: Present): exploitation is not reachable by any arbitrary Internet host - the attacker must control or intercept traffic to the configured Active Directory server, i.e. hold an adversary-in-the-middle or AD-server-compromise position relative to the Firebox. That materially narrows the realistic attacker set compared with a flat AV:N/AT:N bug. No EPSS score is provided in the input, and there is no CISA KEV listing and no PoC/exploit reference, so there is no evidence of active exploitation or public exploit code at this time. The impact metrics (VC:H/VI:H/VA:H) reflect the description's claim of denial of service and potential arbitrary code execution; note the description says code execution is 'potentially' achievable, so RCE is plausible but not confirmed as demonstrated. Net: prioritize patching because this sits on a security appliance's authentication path and the vendor flags act_now, while recognizing the AT:P precondition makes opportunistic mass exploitation less likely than the raw 9.2 suggests.

An attacker who already holds a man-in-the-middle position on the network path between a WatchGuard Firebox and its configured Active Directory server (or who has compromised that AD server) waits for the appliance to perform an AD authentication exchange and returns a specially crafted response. The malformed response overflows a heap buffer in the Fireware OS authentication service, crashing it (denial of service) and potentially allowing arbitrary code execution on the appliance. No public exploit identified at time of analysis, and the required interception position is the main barrier to opportunistic use.