Which versions of WatchGuard Fireware OS are affected by EUVD-2026-89488?

WatchGuard Fireware OS - the operating system running Firebox perimeter firewalls - contains an unauthenticated remote code execution flaw in its DHCP fingerprinting service that can be triggered by…. A patch is available.

How to fix or mitigate EUVD-2026-89488?

Within 24 hours, inventory every WatchGuard Firebox running Fireware OS and determine which of its interfaces participate in DHCP processing on segments reachable by non-trustworthy hosts; there is no vendor-released patch identified at time of analysis, so containment must be architectural. Immediately move DHCP-serving off any Firebox interface that shares a broadcast domain with guest, IoT, contractor, or otherwise untrusted devices, disable the DHCP fingerprinting/fingerd functionality on Firebox interfaces where it is not strictly required, and enforce strict Layer 2 port security - disabling unused switch ports, applying MAC limiting and 802.1X where feasible, and pruning VLANs so untrusted devices cannot land on the same segment as a Firebox interface. Within 7 days, confirm the interim design in writing with WatchGuard support or your reseller, subscribe to WatchGuard's security advisory feed and the CISA KEV catalog to catch the patch the moment it lands, and validate that management interfaces and the DHCP path are not reachable from any untrusted VLAN via a targeted internal scan or configuration review. Within 30 days, deploy the WatchGuard Fireware OS update as soon as the vendor releases it - treat that deployment as an emergency change with a same-week rollout window across all Fireboxes - and re-validate segment isolation for every Firebox interface, documenting the final rule set and completing a post-change verification that no untrusted device can reach the DHCP-processing path.

WatchGuard Fireware OS EUVD-2026-89488

Q: What is the CVSS score of EUVD-2026-89488?

EUVD-2026-89488 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-81433 HIGH

Classic Buffer Overflow (CWE-120)

2026-09-29 WatchGuard

GHSA-h8f9-rp2r-962g

RCE Buffer Overflow Fireware Os Watchguard Firmware

8.7

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent DHCP-segment access with no auth or interaction (AV:A/AC:L/PR:N/UI:N); code execution on the appliance yields full C/I/A; scope unchanged as impact is within the daemon's host.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 30, 2026 - 02:01 EUVD

Metadata Corrected

Sep 30, 2026 - 00:40 vuln.today

tag: Firmware added

Analysis Generated

Sep 29, 2026 - 23:53 vuln.today

CVE Published

Sep 29, 2026 - 23:05 cve.org

HIGH 8.7

DescriptionCVE.org

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.

AnalysisAI

Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to be on an adjacent network segment (AV:A) that can deliver DHCP traffic to the Firebox's DHCP-fingerprinting daemon (fingerd) - i.e., the same broadcast/L2 domain or a VLAN the firewall's DHCP-processing interface listens on. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue, not a CVSS-inflated one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch was identified in the supplied intelligence - only the WatchGuard PSIRT advisory (https://psirt.watchguard.com/CVE-2026-81433), which should be treated as the authoritative source for the fixed Fireware OS build and upgrade instructions; the wildcard CPE suggests the advisory applies across multiple firmware versions, so confirm the applicable fixed release there before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WatchGuard Firebox running Fireware OS and determine which of its interfaces participate in DHCP processing on segments reachable by non-trustworthy hosts; there is no vendor-released patch identified at time of analysis, so containment must be architectural. …

Threat intelligence, references, and detailed analysis are available after sign-in.