Zero Radar
← feed
CriticalVulnerabilityCVE-2026-103594updated 27 Oct 2026, 19:35 UTC

WatchGuard Fireware OS can be crashed or taken over via tampered WireGuard config

Attackers who can intercept and decrypt the connection between a WatchGuard firewall and WatchGuard Cloud could send a fake settings file. This could crash the firewall or possibly let the attacker run their own code on it.

Official, 2 sources
SeverityCriticalCVSS 9.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker in the middlePositioned between Firebox and cloud
  2. 2Intercept TLS trafficDecrypts the Firebox-cloud channel
  3. 3Tampered config payloadOversized WireGuard settings sent
  4. 4Firebox overflows bufferStack memory corrupted during parsing
  5. 5Crash or code executionDenial of service, possibly takeover
  6. ResultFirewall crashed or attacker controls it

What happened

A stack-based buffer overflow in Fireware OS's processing of WireGuard configuration payloads from FireCloud Gateway allows denial of service and potentially arbitrary code execution, when an attacker holds man-in-the-middle access to the TLS-decrypted channel between the Firebox and WatchGuard Cloud.

Why it is dangerous: A successful attack could knock the firewall offline or give the attacker control of a device that guards the network perimeter. The risk is highest for organizations whose Fireboxes are managed through WatchGuard Cloud.

Are you affected?

You are affected if you run Fireware OS on a Firebox that is managed through WatchGuard Cloud or FireCloud Gateway and uses WireGuard configuration.

Fireware OS with WireGuard configuration processing, on Fireboxes connected to WatchGuard Cloud / FireCloud Gateway. Exact affected versions: unknown from the provided material.

What to do

  1. Check your Fireware OS version and compare it with WatchGuard's official advisory for CVE-2026-103594
  2. Update Fireware OS to the fixed version named in WatchGuard's advisory as soon as it is available to you
  3. Until patched, restrict and monitor the Firebox's connection to WatchGuard Cloud and review any WireGuard configuration changes

Timeline

  1. 27 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 19:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-103594 · GHSA-69hq-vhp9-m5w6
CVSS
9.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 16:17 UTC
On Zero Radar
27 Oct 2026, 16:20 UTC (3 min after disclosure)
Last change
27 Oct 2026, 19:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WatchGuard Fireware OS can be crashed or taken over via tampered WireGuard config · Zero Radar