Preparing the evidence trail for a Fireware OS CVE-2026-18145 incident

Build the record before you need it

WatchGuard's September 29, 2026 Fireware OS update fixed 14 vulnerabilities on Firebox appliances. CVE-2026-18145 is the stack-based buffer overflow in spamd, rated 8.6 under CVSS v4 with remote code execution as the impact class.
The vendor reports no confirmed exploitation and no public proof of concept for the batch. Preparation is still the right move, because a memory corruption bug in a service that reads mail from untrusted sources is exactly the kind of issue that produces ambiguous signals.

Know your baseline

Record the build each appliance runs and the services it is meant to offer. Fixed releases are Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21, with EUCC-certified 12.11 units on 12.11.10.
A baseline turns a vague report of instability into a comparison. Without it, every restart looks the same.

Know where the logs go

Confirm that the appliance forwards logs to a system that is not the appliance itself. A device under memory corruption pressure is a poor place to store its own evidence.
Check retention on the receiving side too. If the window is short, an incident discovered late will have nothing to work with.

Know what to look for

The public record for CVE-2026-18145 does not describe a specific log signature, so avoid inventing one. Practical signals to watch are service restarts, unexpected reboots, gaps in forwarding, and configuration changes nobody claims.
Treat those as leads to investigate, not proof. Pair each one with the version check and the configuration review.

Keep the management plane reachable only from trusted networks

That single control changes the difficulty of reaching many appliance services at once. Add a review of BOVPN Over TLS and IKEv2 peers, since the same batch ties its most severe entries to those configurations.

Exposure context

A ZoomEye query for the fingerprint app="WatchGuard-Firebox" returned 168 assets at the time of writing. The figure covers internet-visible Firebox fingerprints and carries no firmware detail, so it belongs in the population estimate, not the incident report.

Sources

• SecurityOnline: WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE
• WatchGuard PSIRT portal, advisory entry for CVE-2026-18145.