External risk intelligence

Heap Buffer Overflow in Fireware OS Authentication Service Leads to Denial of Service and Potential Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-112709

The vulnerability resides in the Fireware OS authentication service's communication with an Active Directory server. This interaction typically occurs over internal, trusted network segments between the appliance and the domain controller, rather than directly exposing the service to the public internet.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified within the Fireware OS authentication service that could allow an attacker to disrupt service or potentially execute unauthorized code. This issue arises from how the service handles responses from an Active Directory server, with the main concern being to confirm relevance and exposure within our environment.

Authentication service vulnerability.
Potential for service disruption or code execution.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker who can intercept or control traffic to the device's Active Directory server could exploit a vulnerability in the Fireware OS authentication service. By sending a specially crafted response to the authentication service, an attacker could trigger a heap-based buffer overflow, leading to a denial of service or potentially allowing arbitrary code execution.

Requires traffic interception or control.
Triggers overflow in authentication service.
Risk of denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow in the Fireware OS authentication service could lead to a denial of service or arbitrary code execution when an attacker controls or intercepts traffic to the Active Directory server. This could affect the availability and integrity of the authentication service.

Authentication service availability.
Specially crafted Active Directory responses.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Fireware OS authentication service requires investigation by infrastructure and security teams responsible for network perimeter devices and authentication infrastructure. The initial practical step is to identify all Fireware OS instances, assess their exposure to Active Directory servers, and confirm business criticality before planning remediation.

Infrastructure and security teams own this.
Verify Active Directory server reachability.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fireware OS?

Fireware OS is the primary operating system used by WatchGuard network security appliances. It manages firewall traffic, VPN connections, and security services. The authentication service within this system specifically handles identity verification by communicating with external directories, such as Active Directory, to control user access to the network.

What does CWE-122 mean for CVE-2026-112709?

CWE-122 refers to a heap-based buffer overflow. In this context, it means the authentication service fails to safely manage the memory space allocated for incoming data. If the service receives a maliciously structured response from a server, it may overflow that memory, potentially crashing the service or allowing an attacker to run their own code.

How does an attacker trigger this vulnerability?

The attacker must be positioned to control or intercept network traffic flowing between the Fireware OS appliance and its configured Active Directory server. Simply sending data to the firewall's public-facing interfaces will not trigger this; the malicious input must arrive specifically as a fraudulent response disguised as legitimate communication from the internal domain controller.

Is my Fireware OS appliance at risk?

Halo Surface Signal indicates that risk is unlikely for most deployments. Because the vulnerability involves communication with an internal Active Directory server, the service is typically isolated from the public internet. You should focus your investigation on appliances configured to reach Active Directory over network segments that could potentially be intercepted.

What is the first step for my security team?

Begin by inventorying all active Fireware OS instances and documenting their authentication configurations. Determine which appliances communicate with Active Directory and assess the security of the network path between them. Once mapped, coordinate with your vendor to monitor for official updates while ensuring these internal communication paths remain strictly monitored and restricted.

References

psirt.watchguard.com/CVE-2026-112709

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.