Fireware OS version drift: keeping CVE-2026-18145 from reopening

Drift is the real problem

CVE-2026-18145 is a stack-based buffer overflow in spamd on WatchGuard Fireware OS, disclosed on September 29, 2026 in a batch of 14 fixes for Firebox appliances. The vendor scores it 8.6 in CVSS v4 and links it to remote code execution.
Closing the finding once is straightforward. Keeping it closed across a fleet that grows, gets replaced, and gets restored from backups is where most programs fail.

Where drift comes from

Hardware replacement brings a unit back to a default or older image. Disaster recovery restores a configuration snapshot that predates the patch. Branch offices keep spares that were never in scope for the original window.
Each of those events can reintroduce software that predates the fixed releases: Fireware OS 2026.3.2, 2026.2.3, 12.12.3 or 12.5.21, with EUCC-certified 12.11 builds at 12.11.10.

Control the introduction path

Make the fixed build the default image for new deployments and replacements. If spares ship with an older release, update them before they go on the network rather than afterwards.
Tie the configuration backup process to the patch state. A restore should be followed by a version check, because the snapshot describes settings, not software.

Detect drift continuously

Pull the build string from every appliance on a schedule and compare it against the fixed list. A simple report that names the outlier units is enough. The goal is to know about a stale unit before an audit or an incident does.

Why spamd deserves the check

spamd handles spam filtering on the appliance, which means it processes content that arrives from outside. A memory corruption flaw in that path is not a theoretical worry, even though WatchGuard reports no confirmed exploitation and no public proof of concept for the batch.

Exposure context

A ZoomEye query for app="WatchGuard-Firebox" returned 168 matching assets at the time of writing. It counts Firebox devices with an internet-visible fingerprint, which frames the size of the population but says nothing about which builds those units run.

Mitigations while drift is unresolved

Keep management and mail services off untrusted networks, and review BOVPN Over TLS and IKEv2 peers, the settings tied to the most severe items in the same batch.

Sources

• SecurityOnline: WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE
• WatchGuard PSIRT portal, advisory entry for CVE-2026-18145.