Vulnerabilities · 1 day ago
WatchGuard released Fireware OS security updates on Oct. 28, but CERT counts differ: CSIRT Italia lists 14 vulnerabilities—seven critical and seven high—while Spain’s INCIBE-CERT lists seven—six critical and one high. Their listed affected configurations also differ.
One of INCIBE-CERT’s listed flaws, CVE-2026-93865, affects FireCluster: its synchronization service accepts requests to the cluster management IP without checking who sent them, allowing remote callers to invoke privileged administrative actions. That could affect cluster operations, but it is not a blanket flaw on every Firebox. Other reported paths depend on conditions such as a configured FireCloud Gateway or manipulated Active Directory replies.
For Firebox operators, exposure depends on the model and configuration, not just the Fireware version. The reports provide no evidence of exploitation in the wild.
CVEs in this update
12 CVEs
Across Fireware OS.
0 critical · 0 high · 0 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Showing the top 10 by KEV, EPSS, and severity.
2 sources covering this story
Múltiples vulnerabilidades en Fireware OS de WatchGuard
El equipo WatchGuard AI Security Research y Laurent Gaffie, de secorizon.com, han informado sobre 7 vu
WatchGuard: risolte vulnerabilità in Fireware OS
WatchGuard ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui 7 con gravità “critica” e 7 con gravità “alta”, in Fireware OS, sistema operativo utilizzato nei dispositivi di sicurezza perimetrale e di protezione delle reti.
Part of the PlainSec briefing for 2026-10-29