Vulnerability · Published Oct 27, 2026 · Assigned by WatchGuard
CVE-2026-90465Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
High 8.7
In plain English
A high-severity authentication bypass by spoofing in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | Fireware OS | 2025.1 – before 2026.412.0 – before 12.12.4 |
| WatchGuard | Fireware OS | 12.0 – before 12.5.22 |
Weakness: CWE-290, CWE-306, CWE-77, CWE-862 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://psirt.watchguard.com/CVE-2026-90465 vendor-advisory