Is CVE-2026-113881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113881 being exploited in the wild.

How severe is CVE-2026-113881?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Watchguard Fireware OS 2025.1 to 2026.3 and 12.9 to 12.12.3.

How is CVE-2026-113881 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-113881?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113881: WatchGuard Fireware OS stack buffer overflow in VPN Network Access Enforcement

CVE-2026-113881 · Severity: info · Published 2026-10-27

Fireware OS is an operating system that runs on WatchGuard Firebox security appliances and provides VPN access for remote employees. An authenticated user connecting via mobile VPN can trigger a buffer overflow by sending a crafted request, potentially leading to a service outage or unauthorized code execution on the firewall. This requires the firewall to have Network Access Control enabled for Mobile VPN and affects specific Fireware OS versions.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-113881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113881 being exploited in the wild.
How severe is CVE-2026-113881?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Watchguard Fireware OS 2025.1 to 2026.3 and 12.9 to 12.12.3.
Is there a fix for CVE-2026-113881?: Yes: fixed in Fireware OS 2026.4, Fireware OS 12.12.4. Until then: Disable Network Access Control for Mobile VPN until the system can be upgraded to a patched version, or restrict Mobile VPN access to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113881 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-113881?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fireware OS 2026.4, Fireware OS 12.12.4

Disable Network Access Control for Mobile VPN until the system can be upgraded to a patched version, or restrict Mobile VPN access to trusted users only.

Technical details

A stack-based buffer overflow exists in the VPN Network Access Enforcement process (CWE-121, CWE-129) that can be triggered by an authenticated mobile VPN user sending a specially crafted request. An attacker with valid VPN credentials can achieve denial of service or execute arbitrary code with unprivileged process rights. The vulnerability requires Network Access Control to be enabled for Mobile VPN deployments on affected Fireware OS versions.

Affected products

WatchGuard Fireware OS 2025.1 to 2026.3 and 12.9 to 12.12.3

Timeline

2026-10-27: disclosed
2026-10-27: advisory

References

https://psirt.watchguard.com/CVE-2026-113881

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.