WatchGuard Fireware OS: Remote code execution via WireGuard configuration (CVE-2026-103594)

WatchGuard has identified a critical stack-based buffer overflow vulnerability (CVE-2026-103594) in Fireware OS. The flaw exists within the component responsible for processing WireGuard configurations. An attacker who can perform a man-in-the-middle (MitM) attack to intercept and modify TLS-decrypted traffic between a Firebox device and the WatchGuard Cloud can induce a Denial of Service (DoS) or achieve remote code execution. The vulnerability requires the attacker to tamper with the FireCloud Gateway configuration payload.

Impact

Successful exploitation allows for a remote Denial of Service condition or the potential for arbitrary code execution on the affected Firebox device.

Recommendation

• Review the official advisory at https://psirt.watchguard.com/CVE-2026-103594 for patch availability and specific firmware version requirements.
• Implement strict TLS inspection and validation policies for traffic between Firebox appliances and WatchGuard Cloud to mitigate the risk of configuration tampering.
• Monitor logs for unusual configuration change events or service instability on Firebox devices that may indicate attempted exploitation.