Medium 6.0

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature...

CVE-2026-104381 First seen on SecPulse 00:52

Affected packages

Ecosystem	Package	Affected	Fixed
WatchGuard	Fireware OS	≥ 12.0, < 12.5.22	12.5.22

Original description The description as published by the source.

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v4: Medium 6.0; CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Published: Oct 28, 2026
First seen on SecPulse: 00:52
GHSA: GHSA-3qq2-3hjm-m64g
CWE: CWE-294

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

CWE-294 CWE-306

All

CWE-345 Fireware Os

Vendors

Watchguard

Detection sources

NIST National Vulnerability Database01:17
GitHub Security Advisories (Global)03:31
CVE.org (CVE Program・cvelistV5)00:52