Missing Authentication in Fireware OS Affecting WatchGuard
CVE-2026-104381

6MEDIUM

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
27 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-104381?

A vulnerability in Fireware OS’s FireCluster state synchronization feature allows an unauthenticated attacker who has access to the cluster synchronization network segment to terminate VPN tunnels. This is executed by sending specially crafted synchronization traffic, posing significant security risks to the network's integrity.

Affected Version(s)

Fireware OS Default 2025.1 < 2026.4

Fireware OS Default 12.0 < 12.12.4

Fireware OS T15/T35 12.0 < 12.5.22

References

https://psirt.watchguard.com/CVE-2026-104381
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WatchGuard AI Security Research
.