Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
WatchGuard Fireware OS: 18 advisories, 7 critical (CVSS 9.1–9.5), including pre-auth remote code execution in the AD authentication service (CVE-2026-112709, CVE-2026-112710), the SIP proxy (CVE-2026-93857) and WireGuard setup (CVE-2026-103594). https://vulnipulse.com/vendors/watchguard
WatchGuard disclosed CVE-2026-93857 on Oct 27: an unauthenticated attacker can execute code by sending a crafted request through a Firebox policy that uses the SIP proxy. WatchGuard lists Fireware OS 2026.4 or 12.12.4 as fixed versions, with 12.5.22 for T15/T35 appliances. Check whether your policies use the SIP proxy and apply the appropriate update. WatchGuard reports no known exploitation in the wild. https://psirt.watchguard.com/CVE-2026-93857/
➕ Same Fireware OS update also fixes CVE-2026-93857 ⚠️ Pre-auth stack overflow in the SIP proxy: unauthenticated remote code execution via crafted request 📊 CVSS 4.0: 9.2 (WatchGuard) 🎯 Only if a SIP proxy is configured 🛡️ Not known exploited 🔗 https://psirt.watchguard.com/CVE-2026-93857