WatchGuard Fireware Updates Fix 18 New Security CVEs
Tech GuruQuick Answer
WatchGuard published 18 new CVEs for Fireware and the Windows SSL VPN client. Inventory exact platforms and branches, deploy Fireware 2026.4/12.12.4 or T15/T35 12.5.22 where applicable, update the VPN client, validate services, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Fireboxes, models and platforms, Fireware branches and builds, FireCluster, AD authentication, WireGuard, SIP proxy, Access Portal, AuthPoint, VPN clients, owners, and maintenance windows. Match each appliance or client to the individual record's platform and version range; do not apply the broadest default-branch boundary to narrower records or unsupported models. Install Fireware OS 2026.4 or 12.12.4, T15/T35 12.5.22 where the record lists that branch, and Mobile VPN with SSL Client for Windows 2026.4, as applicable. Confirm running builds and client versions, test HA sync, authentication, VPN, WireGuard, SIP, logging and management workflows, review relevant alerts where warranted, and retain evidence.
Last verified: 2026-10-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | WatchGuard Fireware OS and Mobile VPN with SSL Client for Windows |
|---|---|
| Advisory | WatchGuard PSIRT 2026-10-27 Fireware batch |
| CVEs | CVE-2026-103593, CVE-2026-103594, CVE-2026-104381, CVE-2026-111107, CVE-2026-112709, CVE-2026-112710, CVE-2026-113881, CVE-2026-115495, CVE-2026-82332, CVE-2026-90442, CVE-2026-90464, CVE-2026-90465, CVE-2026-93434, CVE-2026-93857, CVE-2026-93862, CVE-2026-93864, CVE-2026-93865, CVE-2026-93866 |
| Authoritative release date | 2026-10-27 15:52:32.654721 UTC |
| Authority revision date | 2026-10-27 15:55:13.854582 UTC |
| Affected versions | The product and platform ranges in the 18 WatchGuard records, primarily Fireware OS default branches before 2026.4 or 12.12.4, T15/T35 before 12.5.22 where listed, and Mobile VPN with SSL Client for Windows before 2026.4; several records have narrower starting versions. |
| Fixed version | Fireware OS 2026.4 and 12.12.4; T15/T35 12.5.22 where listed; Mobile VPN with SSL Client for Windows 2026.4 |
| CVSS base score | 5.6 to 9.5 (CVSS v4.0) |
| CVSS severity | Medium to Critical |
| Exploitation status | WatchGuard states in the individual records that it is not aware of exploitation in the wild.; no exploitation claim is inferred. |
What Changed
WatchGuard published 18 records covering multiple pre-authentication remote-code-execution paths, FireCluster and VPN weaknesses, authentication and session issues, denial of service, local root file modification, and cleartext VPN credentials.
What To Validate Now
- Inventory. Inventory Fireboxes, models and platforms, Fireware branches and builds, FireCluster, AD authentication, WireGuard, SIP proxy, Access Portal, AuthPoint, VPN clients, owners, and maintenance windows.
- Establish applicability. Match each appliance or client to the individual record's platform and version range; do not apply the broadest default-branch boundary to narrower records or unsupported models.
- Remediate. Install Fireware OS 2026.4 or 12.12.4, T15/T35 12.5.22 where the record lists that branch, and Mobile VPN with SSL Client for Windows 2026.4, as applicable.
- Validate. Confirm running builds and client versions, test HA sync, authentication, VPN, WireGuard, SIP, logging and management workflows, review relevant alerts where warranted, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
This grouped notice preserves all 18 CVE identities, but prerequisites differ materially. Plan branch-specific upgrades and avoid treating an unaffected platform as exposed solely because it runs Fireware.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
