WatchGuard Fireware OS Vulnerability Could Allow Remote Code Execution (CVE-2026-18145)

A high-severity security vulnerability in WatchGuard Fireware OS could allow an authenticated administrator to crash the spamBlocker service or potentially execute arbitrary code on affected Firebox devices.

Tracked as CVE-2026-18145, the vulnerability is a stack-based buffer overflow in the spamd service used by the Fireware OS spamBlocker component. The flaw was publicly disclosed on 30 September 2026 and has been assigned a CVSS v4.0 score of 8.6.

What is CVE-2026-18145?

CVE-2026-18145 is classified as a CWE-121 stack-based buffer overflow.

The vulnerability affects the spamBlocker (spamd) service within WatchGuard Fireware OS. According to the vulnerability disclosure, an authenticated attacker with administrator privileges can send a specially crafted management request that causes the service to overwrite data in a fixed-length stack buffer.

If successfully exploited, the vulnerability can result in a denial of service by crashing spamd. More seriously, exploitation could allow arbitrary code execution in the context of the affected service.

The Zero Day Initiative (ZDI), which credited Nicholas Zubrisky of TrendAI Research with discovering the vulnerability, says the problem is related to insufficient validation of the length of user-supplied xpath and parameter values handled by the spamd daemon’s status and action handlers. These values can subsequently be copied into a fixed-length stack buffer.

Who is affected?

The vulnerability affects several branches of WatchGuard Fireware OS.

According to WatchGuard’s security advisory, affected versions include:

Fireware OS	Affected versions	Fixed version
Fireware OS	2026.3 to before 2026.3.2	2026.3.2
Fireware OS	2025.0 to before 2026.2.3	2026.2.3
Fireware OS	12.0 to before 12.12.3	12.12.3
Fireware OS on T15/T35	12.0 to before 12.5.21	12.5.21

These version ranges are also recorded in the CVE record published by WatchGuard.

Systems running the fixed releases are not affected by CVE-2026-18145.

Administrator access is required

One important limitation is that this is not an unauthenticated remote attack.

The attacker needs to be authenticated and have administrator-level privileges before they can attempt to exploit the vulnerability. The CVSS v4 attack characteristics therefore include:

• Network attack vector
• Low attack complexity
• No additional attack requirements
• High privileges required
• No user interaction
• High potential impact to confidentiality, integrity and availability

The resulting CVSS v4.0 score is 8.6, rated High.

This requirement for administrative access reduces the initial attack surface compared with vulnerabilities that can be exploited directly by an unauthenticated internet attacker. However, an attacker who has already obtained Firebox administrator credentials could potentially use the vulnerability to gain further control of the device.

Potential for remote code execution

The most significant aspect of CVE-2026-18145 is the possibility of arbitrary code execution.

A stack-based buffer overflow occurs when data written to a buffer allocated on the program’s stack exceeds the space allocated for that buffer. Depending on how the vulnerable code is constructed and protected, an attacker may be able to overwrite adjacent memory and manipulate program execution.

In this case, ZDI reports that the vulnerable data can be used to execute code in the context of the spamd process.

The practical impact would depend on the privileges and security boundaries associated with the service, as well as the attacker’s ability to reliably control execution.

No known exploitation in the wild

At the time of publication, WatchGuard said it was not aware of exploitation of CVE-2026-18145 in the wild. The available vulnerability records also do not identify a confirmed public exploit.

This status can change after public disclosure. Vulnerabilities involving network security appliances can attract significant attention because successful exploitation of a firewall or security gateway may provide an attacker with a strategic position inside an organisation’s network.

Vulnerability disclosure

The vulnerability was reported to WatchGuard by Nicholas Zubrisky of TrendAI Research on 2 June 2026.

WatchGuard subsequently developed a fix, with the vulnerability being publicly disclosed on 30 September 2026 as part of the coordinated disclosure process. ZDI assigned the issue the identifier ZDI-26-750 and the original research identifier ZDI-CAN-31623.

The CVE record lists WatchGuard as the assigning authority and identifies CWE-121, Stack-based Buffer Overflow, as the associated weakness.

How to protect against CVE-2026-18145

Organisations running affected Fireware OS versions should check the firmware version of their WatchGuard Firebox devices and upgrade to an appropriate fixed release.

The available fixes are:

• Fireware OS 2026.3.2
• Fireware OS 2026.2.3
• Fireware OS 12.12.3
• Fireware OS 12.5.21 for affected T15/T35 systems

WatchGuard’s security advisory lists these releases as addressing CVE-2026-18145.

Administrators should also ensure that access to Firebox management interfaces is restricted to trusted users and networks. Since exploitation requires administrator privileges, protecting management credentials and limiting administrative access can reduce the opportunity for exploitation.

Organisations should also monitor administrative activity and investigate unexpected management requests or unusual behaviour from Firebox devices.

Why this vulnerability matters

CVE-2026-18145 demonstrates the risks associated with vulnerabilities in network security appliances.

Although an attacker needs administrator privileges, successful exploitation could potentially move beyond simply crashing the spamBlocker service and result in arbitrary code execution. Because Firewalls sit at important network boundaries, compromise of such a device can have consequences beyond the individual service affected by the vulnerability.

There is currently no indication that CVE-2026-18145 is being exploited in the wild, but patches are already available. Organisations using affected Fireware OS versions should therefore verify their firmware versions and apply the appropriate update rather than relying solely on the absence of known exploitation.

CVE: CVE-2026-18145
Product: WatchGuard Fireware OS
Component: spamBlocker / spamd
Vulnerability: Stack-based buffer overflow
CWE: CWE-121
CVSS v4.0: 8.6 High
Attack requirements: Authenticated administrator access
Potential impact: Denial of service and arbitrary code execution
Exploitation: No known exploitation reported at disclosure
Fix: Fireware OS 2026.3.2, 2026.2.3, 12.12.3 or 12.5.21, depending on platform and branch.