EUVD-2026-111158
GHSA-w55x-mg3c-c6x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain code execution as low-privileged process
-
DeliveryPlant crafted link/filesystem object
-
ExploitTrigger firewall IP-set list update
-
ExecutionRoot daemon follows link, writes file
-
ImpactOverwrite arbitrary file and tamper IP sets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have code execution as a low-privileged system process on the WatchGuard Fireware OS appliance (AV:L, PR:L) - it is not remotely reachable without a prior foothold. The attacker must then be able to plant a crafted filesystem object (a link) in a location the firewall daemon processes and must trigger a firewall IP-set list update to make the root daemon follow the link. Limiting factors: written content is only partially constrained (the attacker does not get fully arbitrary bytes), the local-only vector, the low-privilege-but-still-authenticated starting point, and the need to satisfy the specific list-update trigger condition (reflected as AT:P). The exact filesystem path and trigger mechanism are not described in the available sources. |
| Impact | This is a local privilege-escalation / arbitrary-file-overwrite flaw, not a remote issue. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) scores 7.1 (High), driven entirely by integrity and availability impact (VC:N but VI:H/VA:H and subsequent-system SI:H/SA:H reflecting the jump to root); there is no confidentiality impact. The AV:L and PR:L metrics confirm the attacker must already run code as a low-privileged system process on the appliance before this bug is reachable, and AT:P indicates a specific precondition (planting a filesystem object and triggering an IP-set list update) must be arranged. No EPSS score was provided, the CVE is NOT in CISA KEV, and no PoC/exploit reference appears in the input, so exploitation is unproven. The vuln.today decision label is 'this_week' and a vendor patch exists, which together argue for prompt but not emergency remediation. Net assessment: a genuine root-escalation primitive that is valuable as the second stage of an attack chain, but low standalone risk because it requires an existing foothold on the firewall - treat as a this_week patching priority consistent with the decision label, not a drop-everything emergency. Note: the 'RCE' tag overstates this; the description explicitly presupposes prior code execution, so this is privilege escalation, not remote code execution. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution as a low-privileged system process on a WatchGuard firewall (for example by chaining a separate initial-access flaw) plants a crafted filesystem object such as a symbolic link and then triggers a firewall IP-set list update. The firewall daemon, running as root, follows the planted link and writes attacker-influenced (partially constrained) content to an arbitrary file, enabling escalation to root and tampering with firewall IP-set data. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Local privilege escalation and arbitrary file overwrite in WatchGuard Fireware OS let an attacker who already holds code execution as a low-privileged system process write files with root privileges and tamper with firewall IP set data. The attacker plants a crafted filesystem object such as a link in a location the firewall daemon processes, then triggers a firewall IP-set list update so the root-privileged daemon follows it; the written content is only partially constrained and the list-update precondition must be satisfied. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, with fixed builds available from the vendor.
RemediationAI
Vendor-released patches are available: update to Fireware OS 12.5.22 on the 12.5.x branch, 2026.4 on the 2025.1 branch, and 12.12.4 on the 12.12.x branch, following the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-93864. The vendor reports patch availability for all listed branches and the available sources do not document any workaround, so the fixed firmware is the remediation path; until an appliance is updated, the exposure is limited to devices on which an attacker has already obtained code execution as a low-privileged system process and can trigger a firewall IP-set list update. Given the vendor priority of this_week, schedule the firmware upgrade in the current patch cycle and verify the installed build against the fixed versions above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the firewall daemon in WatchGuard Fireware OS, which performs IP-set list updates on behalf of firewall policy and runs with root privileges on the appliance. The flaw is classified as CWE-22 (path traversal) and manifests as a link-following problem: a lower-privileged system process can create a crafted filesystem object - a link - whose resolution by the privileged daemon redirects a write to an arbitrary target path. Because the write crosses from a low-privileged context to root and can also alter firewall IP set data used by policy enforcement, the assessed CVSS 3.1 vector carries a scope change (S:C) with high integrity impact on both the vulnerable component and dependent systems, while confidentiality is unaffected. The CVSS 4.0 AT:P component reflects that a specific list-update trigger condition must be met before the daemon follows the planted object, and the written content is only partially constrained, so the attacker does not obtain fully arbitrary byte control over the target file. The exact filesystem path and the precise trigger mechanism are not described in the available sources.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Local foothold needed (AV:L, PR:L); the plant-and-trigger precondition maps to AC:H; low-priv process writing as root is a scope change (S:C); no confidentiality impact, high integrity/availability.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.
Executive ViewAI
WatchGuard Fireware OS contains a high-severity local privilege escalation and arbitrary file overwrite vulnerability (CVE-2026-93864) that allows an attacker with existing low-privileged code execution to gain root-level write access and tamper with firewall IP set data. This affects organizations relying on WatchGuard firewalls for network security, potentially enabling attackers to bypass security controls or disrupt operations. While no public exploit code has been identified, the availability of a patch means leadership should prioritize remediation to prevent potential insider or post-compromise escalation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB