TWCERT: Two High-Severity AD Authentication Service Vulnerabilities in WatchGuard Fireware OS (CVE-2026-112709 / CVE-2026-112710)

Source-Supported Details

On 2026-11-06, TWCERT/CC issued a vulnerability advisory for WatchGuard Fireware OS identifying CVE-2026-112709 and CVE-2026-112710 ^[1]. WatchGuard PSIRT explained that both flaws are heap buffer overflows in the AD authentication service, where an attacker capable of controlling or intercepting traffic to a configured AD server could cause a denial of service and potentially execute arbitrary code ^[2].

Affected versions listed by TWCERT include Fireware OS 2025.1 prior to 2026.4, 12.0 prior to 12.12.4 for non-T15/T35 models, and 12.0 prior to 12.5.22 for T15/T35 models ^[1]. WatchGuard noted that exposure requires an Active Directory authentication server configuration ^[2]. WatchGuard stated it is not aware of any exploitation in the wild ^[2].

Update to Fireware OS 2026.4, 12.12.4, or 12.5.22 for T15/T35 models (depending on hardware model) ^[2].

Source excerpt: "Both vulnerabilities occur when a Firebox device is configured with an Active Directory authentication server, allowing an unauthenticated remote attacker to control or intercept traffic to that server and trigger the flaw via a crafted response, resulting in denial of service or arbitrary code execution." ^[1].

Source excerpt: "This vulnerability affects Firebox deployments configured with an Active Directory authentication server." ^[2].

Source excerpt: "WatchGuard is not aware of any exploitation of this vulnerability in the wild." ^[3].