Plan Fireware OS maintenance for affected Firebox roles
WatchGuard has published critical advisories for two distinct Fireware OS conditions. CVE-2026-93866 applies to Firebox deployments where Access Portal is enabled. CVE-2026-93865 applies to appliances that are FireCluster members with FireCluster enabled. An appliance may need review for either condition, depending on its enabled administrative roles.
These advisories support maintenance planning, but they do not establish the version, exposure, configuration, or remediation state of any particular environment. Review the official Access Portal advisory and FireCluster advisory alongside your appliance inventory.
Identify the applicable release path
The affected ranges are Fireware OS 2025.1 before 2026.4 and 12.0 before 12.12.4. For T15 and T35 appliances, the applicable 12.x fixed release is 12.5.22. Confirm the appliance model, installed branch, support status, and whether Access Portal or FireCluster is enabled before selecting a release.
- For affected 2025.1 deployments, plan for Fireware OS 2026.4.
- For affected 12.x deployments other than the T15 and T35 exception, plan for Fireware OS 12.12.4.
- For affected T15 and T35 appliances, plan for Fireware OS 12.5.22.
- Use the vendor’s current compatibility and lifecycle guidance to confirm that the chosen branch remains supported for the appliance.
The vendor assigns a CVSS v4.0 score of 9.2 to each issue and reports no awareness of exploitation in the wild. Treat that statement as reported context, not as confirmation that a particular deployment is safe or unaffected.
Prepare a controlled maintenance window
Identify service owners, dependency owners, and a maintenance contact before changing production appliances. Review release notes and compatibility considerations for routing, remote access, cluster behavior, monitoring, and any management integrations.
Readers should preserve their own approved recovery materials and document a rollback decision point before maintenance. Keep this reader-side preparation separate from the update itself: it is a recovery plan for authorized administrators, not a substitute for applying the supported fixed release.
Coordinate clustered appliances carefully
For FireCluster members, use WatchGuard’s supported maintenance guidance for the cluster topology and confirm expected service ownership, member health, and recovery responsibilities in advance. Do not assume the process is interruption-free; communicate the maintenance window and contingency plan to affected stakeholders.
Perform safe checks and supported remediation
Use the authenticated WatchGuard administrative interface and official documentation to check the appliance model, installed Fireware OS version, enabled product roles, and available supported update path. Avoid untrusted testing tools or public technical write-ups that attempt to validate the issue against a live appliance.
If the relevant role is enabled and the installed release falls within the supplied affected range, schedule the applicable vendor-supported update.
Verify after maintenance
After the approved update and any required vendor-directed restart or role recovery, confirm through normal administrative views that the appliance reports the intended fixed release. Confirm that only required services remain enabled, that expected administrative access works, and that monitoring shows the appliance and any cluster members in their expected state.
- Record the final version, appliance model, enabled role review, maintenance time, and any follow-up owner.
- Review ordinary operational alerts for unexpected changes during the maintenance period.
- Escalate unresolved health, compatibility, or service concerns through the vendor’s supported channels.
- Retain stakeholder communications and recovery decisions according to your organization’s policy.
Sources
Consult WatchGuard’s official advisories for current product guidance: CVE-2026-93866 and CVE-2026-93865.
Related support and maintenance
Browse the hosting guides for related infrastructure maintenance. For help planning an authorized change, contact Help4 Network; use the vendor support channel for product-specific repair instructions.
Image: AI-generated editorial illustration, not a product screenshot.
