Firebox and Fireware OS
CVE-2026-78008: Fireware OS Authenticated Buffer Overflow in wgagent
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Fireware OS (Default) 2025.0 | 2026.2.2 or later |
| Fireware OS (Default) 12.0 | 12.12.2 or later |
| Fireware OS (Default) 2026.3 | 2026.3.1 or later |
| Fireware OS (T15/T35) 12.0 | 12.5.20 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Am I affected?
This vulnerability is exposed through the Fireware OS management interfaces (WSM and the Management Web UI). To reduce risk, do not expose the Fireware OS management interfaces to the internet.
Workarounds
Administrators should not expose the Firebox's management interfaces to untrusted network locations. See our Firebox Remote Management Best Practices (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA10H000000XeAtSAK&lang=en_US) KB article for guidance on how to secure remote management to a Firebox.
Exploitation
WatchGuard is not aware of any exploitation of this vulnerability in the wild.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.