Auditing a WatchGuard Firebox estate for CVE-2026-18145

Why an audit beats a patch ticket

WatchGuard fixed 14 Fireware OS vulnerabilities on September 29, 2026. CVE-2026-18145 is the stack-based buffer overflow in spamd that the vendor rates 8.6 under CVSS v4 and links to remote code execution.
A single upgrade ticket rarely covers an estate where units were bought at different times. Audience matters here: estates drift across branches, and a branch-by-branch audit is what turns a vendor advisory into a closed item.

Step one: build the inventory

List every Firebox appliance and the Fireware OS branch it runs: 12.x, 2025.x or 2026.x. The batch touches all three, and the vulnerable range differs for each CVE inside it.
Record the exact build string, not just the branch. Fireware OS 12.12.3 and 12.5.21 are both fixed releases for this batch, and they belong to different branches.

Step two: rate each unit

Not every appliance deserves the same urgency. Rank units by what they expose. A Firebox with a management interface reachable from the internet, or one that accepts mail traffic from untrusted networks, carries more risk than a unit behind a management VLAN.
Capture that ranking next to the build string so the upgrade order is obvious to whoever performs the work.

Step three: check the whole batch, not one CVE

CVE-2026-18145 is one entry in a set that includes a 9.2 code injection in the BOVPN Over TLS client and a pre-authentication overflow in fingerd. Patching only the spamd issue leaves the rest of the batch open.
Because the fixed builds are shared across the batch, a single upgrade closes all of it. Confirm that against the advisory entries before you schedule anything.

Step four: verify and record

After the upgrade, confirm the running build version and check that expected services came back. Save the version output and the maintenance record.
That record has a second use. If a service restart or a log gap shows up later, you already know what the device looked like before and after the change.

Exposure data to frame the work

A ZoomEye query for app="WatchGuard-Firebox" returned 168 matching assets when this article was prepared. That is a count of Firebox devices with an internet-visible fingerprint. It says nothing about installed firmware, so treat it as context for the size of the population rather than a measure of your own risk.

Mitigations that hold the line

Until the window arrives, restrict management interfaces to trusted networks and review BOVPN Over TLS and IKEv2 peers. WatchGuard states it is not aware of exploitation of these flaws in the wild, and no public proof of concept has been confirmed.

Sources

• SecurityOnline: WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE
• WatchGuard PSIRT portal, advisory entry for CVE-2026-18145.