CVE-2026-103593
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A stack-based buffer overflow exists in the Fireware OS logging service. A network-adjacent attacker who can impersonate or intercept traffic to the configured log server can execute arbitrary code with root privileges by presenting a specially crafted certificate.
Risk Assessment
A network-adjacent attacker could achieve root-level code execution on the firewall device, leading to full system compromise. However, this requires the ability to impersonate or intercept traffic to the log server.
Recommendation
Update Fireware OS to a version containing the fix. Secure communication with the log server (e.g., mutual TLS authentication) and restrict network access to trusted segments.
Other vulnerabilities in Fireware OS
See all- CVE-2026-86105High
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource they are authorized to access.
- CVE-2026-81851Medium
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
- CVE-2026-3343Medium
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
- CVE-2025-13939Medium
A stored XSS vulnerability in the Gateway Wireless Controller module of WatchGuard Fireware OS allows injection of malicious scripts that execute in the administrator's browser.
Original NVD description (English source)
A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS