WatchGuard has released a security update for WatchGuard Fireware OS, the operating system of Firebox firewalls. The vendor fixed 18 vulnerabilities. Eight of them are critical, and six more are rated high.
What we know about the WatchGuard Fireware OS flaws
The most dangerous vulnerability affects the WireGuard settings. It is a buffer overflow with a CVSS v4 score of 9.5. As a result, an attacker can run arbitrary code on the device.
Several other critical bugs have a score of 9.2. Researchers found them in the SIP proxy, Access Portal, the Active Directory authentication service and the FireCluster sync mechanism. Moreover, attackers can exploit some of them without authentication.
At the same time, most critical flaws work only under certain conditions. For example, Access Portal must be enabled, a policy must use the SIP proxy, or clustering must be active. So the risk for each organization depends on its Firebox settings.
As of October 28, nobody has seen active attacks. However, the experience of other vendors shows that attackers quickly look for unpatched devices once fixes are out. This happened, for example, with the Cisco firewall flaws.
Which versions you need to update
- Fireware OS 2025.x and 2026.x: update to version 2026.4.
- Fireware OS 12.x: update to version 12.12.4.
- The 12.5.x branch: update to version 12.5.22.
In addition, you need to update the Mobile VPN with SSL client for Windows separately. It has its own flaw and does not update together with Firebox.
If you cannot update right away, the vendor recommends temporary measures. First, allow access to management interfaces only from trusted addresses. Then disable Access Portal and the SIP proxy if you do not need them. Finally, isolate the FireCluster links.
Why it matters for business
A firewall sits on the border between the corporate network and the internet. If an attacker takes it over, he gets an entry point to the whole infrastructure. That is why vulnerable perimeter devices often become the first target.
Banks, commercial companies and medical facilities use Firebox widely. These are exactly the organizations that store the most financial and personal data. Outdated software on the perimeter is also one of the most common paths to this data, as we wrote in the article about old vulnerabilities in the CISA KEV catalog.
Read also: Hackers attack Cisco email gateways through attachments; Microsoft releases an out-of-band Exchange Server update; Ransomware in 2026: what the new Bitdefender report shows.
How S-byte can help protect Firebox
S-byte is a WatchGuard partner in Ukraine. We will help you close the new flaws quickly and check your perimeter defense:
- WatchGuard Fireware OS updates. We check versions on all Firebox devices and install updates within an agreed maintenance window.
- Firewall audit. We review rules, access to management interfaces and enabled services, including Access Portal and the SIP proxy.
- Technical support with SLA. We follow vendor advisories and install critical updates on time.
- IT consulting and cybersecurity. We help build layered perimeter protection that does not depend on a single device.
Do you use WatchGuard Firebox? Contact S-byte, and we will check your firewalls and help you update them.