CVE-2026-104381#

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

Medium 6.0 CVSS v4.0 › Published 2026-10-27Updated 2026-10-27

Summary #

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

Product status #

Product	Affected	Not affected
Fireware OS
Default	>= 2025.1, < 2026.4, >= 12.0, < 12.12.4	>= 2026.4, >= 12.12.4
T15/T35	>= 12.0, < 12.5.22	>= 12.5.22

Required Configuration for Exposure #

This vulnerability affects Firebox appliances deployed as a Firecluster and configured with at least one BOVPN tunnel.

Weakness Type and Impact #

CWECWE-294Authentication Bypass by Capture-replay
CWECWE-306Missing Authentication for Critical Function
CWECWE-345Insufficient Verification of Data Authenticity
CAPECCAPEC-60Reusing Session IDs (aka Session Replay)
CAPECCAPEC-94Adversary in the Middle (AiTM)

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22

References #

Credits #

WatchGuard AI Security Researchfinder