Is CVE-2026-93866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93866 being exploited in the wild.

How severe is CVE-2026-93866?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Watchguard Fireware OS Default track: 2025.1–2026.3 inclusive, 12.0–12.12.3 inclusive; T15/T35 track: 12.0–12.5.21 inclusive.

How is CVE-2026-93866 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-93866?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93866: WatchGuard Fireware OS integer overflow in WebSocket Access Portal

CVE-2026-93866 · Severity: info · Published 2026-10-27

WatchGuard Fireware OS's Access Portal feature contains an integer overflow vulnerability in its WebSocket connection handling that allows remote attackers without authentication to write data beyond heap buffer boundaries. An attacker exploiting this flaw could corrupt application memory and potentially gain code execution on the firewall, disrupting network security and allowing lateral movement into protected networks.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-93866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93866 being exploited in the wild.
How severe is CVE-2026-93866?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Watchguard Fireware OS Default track: 2025.1–2026.3 inclusive, 12.0–12.12.3 inclusive; T15/T35 track: 12.0–12.5.21 inclusive.
Is there a fix for CVE-2026-93866?: Yes: fixed in Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22. Until then: Disable the Access Portal feature if it is not required, or restrict network access to the Access Portal interface to trusted administrative networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93866 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-93866?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22

Disable the Access Portal feature if it is not required, or restrict network access to the Access Portal interface to trusted administrative networks only.

Technical details

An integer overflow in WebSocket connection handling (CWE-190) allows remote, unauthenticated attackers to trigger an out-of-bounds heap write (CWE-787) by sending specially crafted requests to the Access Portal feature. The vulnerability requires the Access Portal to be enabled on the Firebox appliance and can be exploited over the network without prior authentication or user interaction.

Affected products

WatchGuard Fireware OS Default track: 2025.1–2026.3 inclusive, 12.0–12.12.3 inclusive; T15/T35 track: 12.0–12.5.21 inclusive

Timeline

2026-10-27: disclosed

References

https://psirt.watchguard.com/CVE-2026-93866

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.