WatchGuard Fireware OS EUVD-2026-67329

Exploitation requires an authenticated administrator account on the WatchGuard Fireware OS Management Web UI, confirmed by the CVSS 4.0 PR:H metric - this is not exploitable by unauthenticated or low-privileged users. The attacker must additionally have network access to the management interface (AV:N), which in hardened deployments should be restricted to a dedicated management VLAN or trusted IP range. The vulnerability is triggered specifically by sending specially crafted network traffic to the Web UI, indicating the vulnerable code path lies within the HTTP or management protocol parser. Exploitation is bounded by: (1) mandatory administrator-level authentication as a precondition, (2) network reachability to the management interface, and (3) no scope change, meaning successful exploitation impacts only the Fireware OS host and does not directly propagate to downstream network segments. No non-default configuration is described as required beyond having the Management Web UI accessible.

The CVSS 4.0 score of 8.6 reflects substantial impact potential (VC:H/VI:H/VA:H) constrained by the high privilege requirement (PR:H), meaning an attacker must first hold valid administrator credentials - a non-trivial precondition that sharply limits the realistic attacker population. No EPSS score was present in the input data and cannot be independently derived here. KEV status is absent and no public POC has been identified, so at-scale exploitation probability is currently low. The PR:H requirement is the dominant risk-moderating signal: this is not a walk-up network attack but requires credential compromise, insider threat, or session hijack as a necessary precondition. SSVC framing suggests 'scheduled' rather than emergency remediation for most operators. However, Fireware OS sits on network perimeter devices - a successful post-authentication RCE on a firewall represents a high-value pivot point for lateral movement, persistent access, and traffic interception, making this more consequential than a typical authenticated admin-only flaw in an internal application. The absence of scope change (SC:N/SI:N/SA:N) means the exploit impact is contained to the firewall host itself rather than directly propagating to protected segments.

An attacker who has obtained valid Fireware OS administrator credentials - through phishing, credential reuse, or insider access - authenticates to the Management Web UI and submits a specially crafted HTTP request or management protocol message containing a payload designed to overflow a buffer in the underlying parsing logic. Depending on platform memory protections and heap layout, this results in either a management service crash requiring appliance reboot (DoS) or a control-flow hijack enabling arbitrary code execution on the firewall host itself. No public proof-of-concept code has been identified at time of analysis.