{"id":"CVE-2026-112709","published":"2026-10-27T16:17:29Z","modified":"2026-10-28T14:39:26Z","title":"A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls…","vendor":"WatchGuard","product":"Fireware OS","tier":"core","eol":null,"description":{"text":"A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.","provenance":"source","from":"NVD"},"summary":{"text":"A heap-based buffer overflow in the authentication service of WatchGuard's Fireware OS can be triggered when the device receives a specially crafted response from the configured Active Directory server. An attacker who can control or intercept traffic between the device and that server, with no authentication or user interaction required, can cause a denial of service and potentially execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:56Z"},"cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.00419,"percentile":0.36192,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ae35d945cba1d70e2bf3a79","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ae20c338ef6b2d900217a8b","created":"2026-10-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"},{"id":"CWE-131","name":"Incorrect Calculation of Buffer Size"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-112709","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-111148","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111148","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112709","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.24,"detail":"percentile 0.3619"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.44,"detail":"base score 9.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}