CVE-2026-8247

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120 CWE-787

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.1, < 2026.2.1; >= 12.0, < 12.12.1; >= 11.0, < *
WatchGuard	Fireware OS	>= 12.0, < 12.11.9
WatchGuard	Fireware OS	>= 12.0, < 12.5.19

References

https://psirt.watchguard.com/CVE-2026-8247Broken Link
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00026Vendor Advisory

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-824705.4Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted c CVE-2026-824727.5Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or CVE-2026-824738.2KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can re CVE-2026-824747.8Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to CVE-2026-824758.1iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow o CVE-2026-824765.3Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing una CVE-2026-824775.8In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via th CVE-2026-824787.3A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file tri CVE-2026-824796.3A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if CVE-2026-82486.5A vulnerability was detected in Open5GS up to 2.7.7. The affected element is the function update_authorized_pcc_rule_and_qos of the file /sr CVE-2026-824807.4A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/c CVE-2026-824818.7The cohttp package before 6.3.0 for OCaml allows directory traversal.