CVE-2026-111107

HighCVSS 8.7/10Last modified Nov 4, 2026

Description

A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-248 CWE-476 CWE-1286

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.1, < 2026.4; >= 12.0, < 12.12.4
WatchGuard	Fireware OS	>= 12.0, < 12.5.22

References

https://psirt.watchguard.com/CVE-2026-111107

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1111089.1Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is c CVE-2026-1111096.1The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source CVE-2026-111118.1Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a CVE-2026-1111107.2The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CVE-2026-1111117.2The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site CVE-2026-1111147.5The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all CVE-2026-1111159.1Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTagged CVE-2026-111129.6Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had CVE-2026-1111208.8The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl CVE-2026-1111227.2The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up t CVE-2026-1111236.1FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying u CVE-2026-1111247.1CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to