Zero Radar
← feed
CriticalVulnerabilityCVE-2026-93865updated 27 Oct 2026, 19:35 UTC

WatchGuard Fireware OS: unauthenticated remote admin actions via FireCluster

Attackers on the network can send a specially crafted request to a firewall's cluster management address and make it perform administrative tasks, without logging in. This can give an attacker control over the firewall.

Official, 2 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or credentials needed
  2. 2Crafted requestSent to FireCluster management IP
  3. 3FireCluster daemonAccepts request without authentication
  4. 4Admin action runsPrivileged system-level command executes
  5. ResultAttacker controls the firewall

What happened

A missing authentication check in the Fireware OS FireCluster synchronization daemon lets a remote, unauthenticated attacker invoke privileged system-level administrative actions by sending a crafted request to the FireCluster management IP when clustering is enabled.

Why it is dangerous: A compromised firewall can expose or redirect the traffic it protects, and attackers gain a foothold in the network it guards. Organizations running WatchGuard firewalls in clustered (FireCluster) mode are at risk.

Are you affected?

You are affected if you run WatchGuard Fireware OS with FireCluster clustering enabled and its management IP is reachable by an attacker.

What to do

  1. Check whether FireCluster is enabled on your WatchGuard Fireware devices.
  2. Restrict network access to the FireCluster management IP so only trusted cluster members can reach it.
  3. Apply the vendor's Fireware OS update as soon as it is available and verify the fixed version in the WatchGuard advisory.

Timeline

  1. 27 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 19:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-93865 · GHSA-8j2v-r9q7-whr5
CVSS
9.2 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 16:17 UTC
On Zero Radar
27 Oct 2026, 16:20 UTC (3 min after disclosure)
Last change
27 Oct 2026, 19:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WatchGuard Fireware OS: unauthenticated remote admin actions via FireCluster · Zero Radar