EUVD-2026-89500
GHSA-6g2x-6j83-r28p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered management request with low complexity but requires administrator privileges (PR:H); memory corruption yields full C/I/A impact within the service, no scope change.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.
AnalysisAI
Authenticated attackers with administrator privileges can exploit a stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS by sending a specially crafted management request, causing a service crash or potentially achieving arbitrary code execution. The vulnerability requires the spamBlocker feature to be licensed and enabled, and the management plane to be reachable; exploitation is therefore limited to insiders, stolen admin credentials, or post-compromise scenarios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires administrator-level authentication to the WatchGuard Firebox (PR:H) and reachability of the spamBlocker (spamd) management request handler - meaning the spamBlocker feature is licensed/enabled and the management plane is accessible to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.6 is driven by high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) over a network vector (AV:N) with low complexity (AC:L), but it is materially gated by PR:H - the attacker must already hold administrator privileges on the Firebox. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the provided data; consult the WatchGuard PSIRT advisory (https://psirt.watchguard.com/CVE-2026-18145) for the latest patched firmware release and apply it as soon as it becomes available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether spamBlocker is licensed and enabled on all WatchGuard Fireware OS devices; if not required, disable the feature. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today