Summary
- CVE-2026-112709 affects configured Active Directory authentication in Fireware OS.
- The flaw can cause service denial and potentially code execution via crafted directory responses.
- WatchGuard identifies fixed releases and reports no known exploitation in the wild.
WatchGuard has released security updates for a critical buffer overflow in Fireware OS that affects Firebox appliances configured to authenticate against an Active Directory server. The vulnerability, CVE-2026-112709, can allow denial of service and potentially arbitrary code execution when a maliciously crafted response is processed by the firewall’s authentication service.
The exploit conditions are narrower than an ordinary remotely reachable web-service flaw. WatchGuard specifies that an attacker must control or intercept traffic to the configured Active Directory server. A device must also have that authentication integration enabled. Those prerequisites make the security of the directory connection and the surrounding network particularly relevant to the affected appliance.
Active Directory integration lets organisations use established user and group identities when controlling access through perimeter devices. Instead of maintaining a completely separate identity database on every firewall, an authentication service can consult the organisation’s directory. The integration creates a trust relationship: information returned by the server is processed as part of the firewall’s access decision, and malformed response handling can undermine the boundary between external data and privileged appliance code.
WatchGuard classifies the vulnerability as critical with a CVSS 4.0 score of 9.2. Its advisory describes a heap-based buffer overflow associated with the parsing of authentication responses. A specially constructed response could crash the affected component; successful code execution is a potential consequence, not a demonstrated compromise of any customer environment. The company says it is unaware of exploitation in the wild.
The directory authentication response is a trust boundary even when the directory is operated internally. A compromised internal service, malicious proxy on the network path or other ability to influence those responses can make a parser vulnerability exploitable without the attacker ever connecting directly to a public web interface on the firewall. Conversely, an appliance that does not use the affected Active Directory authentication configuration is outside the condition described in this particular advisory. Risk assessment should follow those configuration details rather than treat the severity score as a substitute for exposure analysis.
WatchGuard identifies a separate fixed software branch for T15 and T35 appliances, which may require a different upgrade from devices running the main Fireware OS line. The vendor’s advisory is configuration-specific and supplies remediation versions; it contains no public claim that attackers have used the issue to execute code against an operational customer firewall.
Patching an edge security device typically has broader operational consequences than patching a single user workstation. Changes must preserve routing, VPN access, authentication and policy behaviour while avoiding prolonged downtime at a site boundary. High availability can reduce disruption, but it does not automatically remove the need to upgrade both members or verify their configurations. WatchGuard’s publication provides the supported fixed releases; it does not establish how many deployed appliances have been updated, whether a public exploit is available or whether a customer has already been compromised.
The affected version ranges span Fireware OS releases before 2026.4 on the newer line and before 12.12.4 on the older 12.x line, with separate support for certain T15 and T35 appliances. WatchGuard names 2026.4, 12.12.4 and 12.5.22 as fixed releases for their respective branches. Administrators need to identify the device model and running software before selecting a patch, rather than assuming the same build applies to every Firebox.
The attack surface also depends on where directory requests travel. A protected, tightly routed connection between a firewall and internal directory infrastructure presents different opportunities from a design in which an adversary could position themselves on the path or compromise the server responding to authentication requests. Updating the appliance corrects the parsing weakness; reviewing directory communication and trust boundaries remains relevant because those connections underpin broader network access controls.
