WatchGuard patches 14 Fireware OS flaws, including RCE rated 8.6
On September 29, 2026, WatchGuard released fixes for 14 Fireware OS vulnerabilities. The key one is CVE-2026-18145, a stack-based buffer overflow in spamd rated 8.6 under CVSS v4 that can lead to remote code execution. Fixed builds cover the 12.x, 2025.x and 2026.x branches, including 12.12.3 and 12.5.21.
- CVE-2026-18145 is a spamd buffer overflow rated 8.6 under CVSS v4, leading to RCE
- The batch fixes 14 flaws, including a 9.2 code injection in BOVPN Over TLS
- Fixed builds include 12.12.3 and 12.5.21 across different Fireware OS branches
- ZoomEye found 168 WatchGuard-Firebox devices with an internet-visible fingerprint
Read next
Security