CVE-2026-90464High· 7.2▾ TwilightAn external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
fireware_os >= 2025.1 < 2026.4fireware_os >= 12.0 < 12.12.4fireware_os >= 12.0 < 12.5.22Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
CVE-2026-90465High· 8.7Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
CVE-2026-93862High· 7.2Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
CVE-2026-112709Critical· 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
CVE-2026-113881Medium· 6.1Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution
CVE-2026-82332Medium· 5.6Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking