CVE-2026-81433: Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-01
Weakness: CWE-120

Description

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.

Affected products

WatchGuard Fireware OS: from 2026.3 before 2026.3.2; from 2025.0 before 2026.2.3; from 12.0 before 12.12.3 — fixed in 12.12.3, 2026.2.3, 2026.3.2

How to fix

Upgrade to a fixed version: WatchGuard Fireware OS 12.12.3, 2026.2.3, 2026.3.2. Check the vendor advisory for mitigations.

References

https://psirt.watchguard.com/CVE-2026-81433

Get alerted when CVE-2026-81433 or the next vulnerability affects your stack