CVE-2026-104381

MediumCVSS 6.0/10Last modified Nov 4, 2026

Description

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-294 CWE-306 CWE-345

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.1, < 2026.4; >= 12.0, < 12.12.4
WatchGuard	Fireware OS	>= 12.0, < 12.5.22

References

https://psirt.watchguard.com/CVE-2026-104381

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1043839.4Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows a CVE-2026-1043848.7Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premi CVE-2026-1043857.5Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-1043866.5Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.Thi CVE-2026-1043877.2Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-1043885.3Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issu CVE-2026-1043898.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Inject CVE-2026-1043904.3Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2026-1043916.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master qui CVE-2026-1043928.8Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue af CVE-2026-1043936.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ CVE-2026-1043947.1Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.