CVE-2026-18105

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2026.3, < 2026.3.2; >= 2025.0, < 2026.2.3; >= 12.0, < 12.12.3
WatchGuard	Fireware OS	>= 12.0, < 12.5.21

References

https://psirt.watchguard.com/CVE-2026-18105Patch, Vendor Advisory

Timeline

Published: Sep 30, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-181064.3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-CVE-2026-181077.8A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can re CVE-2026-181089.8Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose CVE-2026-181097.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and incl CVE-2026-18118.8A flaw has been found in bolo-blog bolo-solo up to 2.6.4. This affects the function importFromMarkdown of the file src/main/java/org/b3log/s CVE-2026-181107.5Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/au CVE-2026-181116.1Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks a CVE-2026-181137.5In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, CVE-2026-181147.5IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path cano CVE-2026-181157.4Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.CVE-2026-181166.1Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approva CVE-2026-181175.4Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog