External risk intelligence

Fireware OS SIP Proxy Stack Overflow Enables Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-93857

The vulnerability resides in a SIP proxy service within a network security appliance (Fireware OS). SIP proxies in such appliances are commonly configured to handle traffic at the network edge or in DMZ segments to facilitate VOIP and unified communications, making them accessible from external networks.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Fireware OS, specifically within its SIP proxy component, allowing remote attackers to execute arbitrary code. This issue could potentially impact systems that utilize the SIP proxy for communication services. The main concern is confirming relevance and exposure.

Unauthenticated attackers can run code remotely.
It affects network security devices.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to a system's SIP proxy, which is exposed to network traffic. This can lead to arbitrary code execution, potentially compromising the affected system.

Network exposure required for access.
Specially crafted requests trigger the vulnerability.
Arbitrary code execution is the primary risk.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in Fireware OS's SIP proxy could allow for arbitrary code execution when processing specially crafted requests through a policy that uses the SIP proxy. This means an attacker could potentially take control of the affected system under certain network configurations.

System control and arbitrary code execution.
Sending crafted requests via SIP proxy.
Potential for unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Fireware OS's SIP proxy could allow unauthenticated remote attackers to execute arbitrary code. Identifying affected systems, confirming their exposure and business criticality, and locating the accountable owner are the immediate first steps before planning remediation.

Assign ownership to Infrastructure/Security teams.
Verify external reachability and asset criticality.
Plan coordinated vendor engagement and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fireware OS?

Fireware OS is the primary operating system powering network security appliances designed to manage traffic, enforce security policies, and protect network perimeters. The SIP proxy component within this OS is specifically used to manage Session Initiation Protocol traffic, which enables Voice over IP (VoIP) and other unified communication services to traverse the firewall or security gateway.

What does CVE-2026-93857 mean?

This CVE describes a stack-based buffer overflow, a memory safety weakness categorized as CWE-121. In plain terms, the SIP proxy fails to properly check the size of incoming data, allowing an attacker to overwrite adjacent memory with malicious instructions. This flaw can cause the system to execute unauthorized commands instead of processing the intended communication request.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends a specially crafted request through a security policy that specifically enables the SIP proxy. It is important to note that sending standard, legitimate SIP traffic will not cause this error; the system only becomes vulnerable when it processes malformed data designed to exceed the allocated memory buffers.

Is my system at risk from this CVE?

Halo Surface Signal indicates this vulnerability is likely relevant if your device handles traffic at the network edge or in DMZ segments. Because SIP proxies are commonly configured to facilitate external communications, any appliance with an internet-facing SIP proxy policy is considered externally exposed and should be prioritized for review.

What should I do to address this issue?

Start by identifying all network appliances running Fireware OS and determining which ones have active policies utilizing the SIP proxy. Once identified, confirm the external reachability of these assets and engage your security or infrastructure teams to review vendor guidance on disabling the affected component or applying necessary updates to mitigate the risk.

References

psirt.watchguard.com/CVE-2026-93857

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.