WatchGuard Fireware OS EUVD-2026-111154

Exploitation requires two specific preconditions: (1) the Firebox must be configured to use Active Directory authentication, and (2) the attacker must control or intercept traffic to that configured Active Directory server - a man-in-the-middle position on the firewall-to-AD path, or compromise of the AD server itself - in order to return a maliciously crafted response. This privileged traffic-interception requirement (reflected as AT:P in the CVSS 4.0 vector) is the primary limiting factor: the attacker needs no credentials on the firewall (PR:N) and no user interaction, but cannot reach the vulnerable code path without first positioning on the AD authentication channel. Deployments not using AD authentication are not exposed via this vector. Affected: Fireware OS 12.0 up to 12.5.22 and up to 12.12.4, and 2025.1 up to 2026.4; updating to the fixed versions is the vendor-provided remediation.

This is a genuine high priority, not an inflated high-CVSS issue, driven primarily by the vendor-assigned severity (CVSS 4.0 base 9.2) and the vuln.today 'act_now' decision label combined with a vendor patch being available. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) shows a network-reachable flaw requiring no authentication on the firewall and no user interaction, but the AT:P flag is decisive: exploitation requires the attacker to first control or intercept traffic to the configured Active Directory server, i.e. a privileged network/man-in-the-middle position rather than direct unauthenticated access. That requirement substantially narrows the realistic attacker set versus a pure AV:N/AT:N bug. Impact is rated high across confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with the description's denial-of-service plus potential arbitrary code execution on a perimeter security appliance. Key signals are MISSING and should be stated explicitly: no EPSS score, no CISA KEV listing, and no POC/exploit reference were provided, so exploitation probability and in-the-wild activity cannot be quantified from this data. The 'act_now' label therefore appears to rest on severity, the sensitivity of the affected asset (a firewall), and patch availability rather than on confirmed exploitation. Overall: treat as urgent patching for any WatchGuard Firebox using Active Directory authentication, while recognizing the attack-requirement (MITM on AD traffic) as a real mitigating factor.

An attacker who has gained a man-in-the-middle position on the network path between a WatchGuard Firebox and its configured Active Directory server (or who has compromised that AD server) waits for the firewall's authentication service to query AD, then returns a specially crafted response that overflows a heap buffer. The result is a denial-of-service crash of the appliance and potentially arbitrary code execution on the firewall itself. No public exploit identified at time of analysis; the attack hinges on first achieving the privileged traffic-interception position (CVSS AT:P).