[ CVE-2026-104381 · Published 27 Oct 2026 ]

Vulnerability in WatchGuard Fireware OS

CVSS 6.0 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund27 Oct 2026WID-SEC-2026-4209

WatchGuard Fireware OS: Multiple vulnerabilities Translated from German
CVE-2026-113881CVE-2026-103593CVE-2026-93434+15 more CVEs

[ References ]References

psirt.watchguard.com/CVE-2026-104381

[ Facts ]Key facts

CVE: CVE-2026-104381
EUVD: EUVD-2026-111160
Published: 27 Oct 2026, 16:17 UTC
Updated: 4 Nov 2026, 21:17 UTC
NVD status: Awaiting Analysis
CVSS 4.0: 6.0 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scored by 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS: 0.13% chance of exploitation in 30 days · higher than 3% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-294 CWE-306 CWE-345

[ Affected ]Affected products

WatchGuard Fireware OS2025.1 – < 2026.4, 12.0 – < 12.12.4

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

WatchGuard Fireware OS: Multiple vulnerabilities Translated from German

[ References ]References