【Vulnerability Alert】WatchGuard Fireware OS Has Two High-Risk Security Vulnerabilities (CVE-2026-112709 and CVE-2026-112710). Please Verify and Take Action as Soon as Possible
publish date :
2026-11-06
update date :
2026-11-06
Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026110409112929 | Publication Time | 2026-11-04 09:53:30 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-11-04 09:53:30 |
| Impact Level | Medium | ||
| [Subject] 【Vulnerability Alert】WatchGuard Fireware OS Has Two High-Risk Security Vulnerabilities (CVE-2026-112709 and CVE-2026-112710). Please Verify and Take Action as Soon as Possible |
|||
| [Content] Forwarded from the National Institute of Cyber Security NISAC-200-202611-00000001 Researchers have discovered two Heap-based Buffer Overflow vulnerabilities (CVE-2026-112709 and CVE-2026-112710) in WatchGuard Fireware OS. When a Firebox device is configured to use an Active Directory authentication server, an unauthenticated remote attacker can exploit these vulnerabilities by controlling or intercepting traffic from the authentication server and sending specially crafted responses, potentially causing a denial of service or arbitrary code execution. Please verify and take action as soon as possible. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] Fireware OS versions 2025.1 through versions earlier than 2026.4 (excluding 2026.4) Fireware OS (Firebox models other than T15 and T35) versions 12.0 through versions earlier than 12.12.4 (excluding 12.12.4) Fireware OS (Firebox T15 and T35) versions 12.0 through versions earlier than 12.5.22 (excluding 12.5.22) |
|||
| [Recommended Actions] The vendor has released patches or updates to address these vulnerabilities. Please refer to the official instructions for remediation. The URLs are as follows: https://psirt.watchguard.com/CVE-2026-112709 https://psirt.watchguard.com/CVE-2026-112710 |
|||
|
[Reference] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-112709 |
|||
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer:
Computer Center