CVE-2026-104381

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

Score

CVSS 4.0 6.0 Medium

Status

Awaiting Analysis - 5d1c2695-1a31-4499-88ae-e847036fd7e3

Published

2026-10-27

Last modified

2026-10-28

Weaknesses

CWE-294, CWE-306, CWE-345

Affected products

• Fireware Os (Watchguard)

References

• https://psirt.watchguard.com/CVE-2026-104381