Fireware OS EUVD-2026-111157

Exploitation requires that the WatchGuard Fireware OS Access Portal feature be enabled on the Firebox appliance - the description explicitly scopes the flaw to 'while the Access Portal feature is enabled,' so appliances without that feature configured are not exposed through this path. Given PR:N/UI:N the attack is remote and unauthenticated with no user interaction once the portal is reachable over the network. The limiting factors are: the Access Portal must be enabled (not a universal/default state), the endpoint must be network-reachable, and the CVSS 4.0 AT:P metric indicates an additional attack requirement must be met; the specific nature of that requirement is not described in the available sources. Affected versions are Fireware OS 12.0 up to <12.5.22, 12.0 up to <12.12.4, and 2025.1 up to <2026.4.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with no user interaction and high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), scoring 9.2. The vuln.today decision label is act_now, and a patch is already available from WatchGuard, which reported the flaw itself. The one factor that tempers raw severity is AT:P (an attack requirement is present) combined with the fact that the Access Portal feature must be enabled for the code path to be reachable - so exposure is limited to appliances with that feature turned on rather than every deployment. No EPSS score is provided and there is no CISA KEV listing, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation; the urgency here rests on the act_now decision label, the critical impact metrics, and the unauthenticated network vector rather than on observed in-the-wild activity. A memory-corruption bug (CWE-190 integer overflow leading to a heap out-of-bounds write) in an internet-facing firewall's clientless portal is a classic target, so defenders running Access Portal should treat this as urgent despite the absence of EPSS/KEV data.

A remote, unauthenticated attacker locates a WatchGuard Firebox with the Access Portal feature enabled and reachable over the network, then sends a specially crafted WebSocket connection-handling request that triggers an integer overflow. The overflow causes a write beyond the bounds of a heap buffer, which can corrupt memory to compromise the appliance's confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the precise trigger beyond 'a specially crafted request' is not described in the available sources.