Is CVE-2026-112710 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112710 being exploited in the wild.

How severe is CVE-2026-112710?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Watchguard Fireware OS 2025.1 to 2026.3, 12.0 to 12.12.3 (T15/T35: 12.0 to 12.5.21).

How is CVE-2026-112710 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-112710?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112710: WatchGuard Fireware OS heap overflow in AD authentication service

CVE-2026-112710 · Severity: info · Published 2026-10-27

WatchGuard Fireware OS is a firewall operating system that protects network traffic and manages authentication. A heap-based buffer overflow in its Active Directory authentication service allows an attacker who intercepts or controls traffic to the AD server to crash the system or run arbitrary code without prior authentication. This affects firewalls configured with Active Directory for user authentication.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-112710 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112710 being exploited in the wild.
How severe is CVE-2026-112710?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Watchguard Fireware OS 2025.1 to 2026.3, 12.0 to 12.12.3 (T15/T35: 12.0 to 12.5.21).
Is there a fix for CVE-2026-112710?: Yes: fixed in Fireware OS 2026.4, 12.12.4, 12.5.22. Until then: This vulnerability requires the attacker to control or intercept traffic to the configured Active Directory server; restrict network access to the AD server or disable AD authentication if not required.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-27" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112710 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-112710?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fireware OS 2026.4, 12.12.4, 12.5.22

This vulnerability requires the attacker to control or intercept traffic to the configured Active Directory server; restrict network access to the AD server or disable AD authentication if not required.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-27" } ]

Technical details

A heap-based buffer overflow exists in the Fireware OS authentication service when processing Active Directory server responses, triggered by a specially crafted AD response. The vulnerability requires the attacker to control or intercept network traffic to the configured Active Directory server. Successful exploitation results in denial of service or pre-authentication remote code execution on the firewall device.

Affected products

WatchGuard Fireware OS 2025.1 to 2026.3, 12.0 to 12.12.3 (T15/T35: 12.0 to 12.5.21)

References

https://psirt.watchguard.com/CVE-2026-112710

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.