CVE-2026-18145

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://psirt.watchguard.com/CVE-2026-18145	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::

History

08 Oct 2026, 19:48

Type	Values Removed	Values Added
First Time		Watchguard Watchguard fireware
CPE		cpe:2.3:o:watchguard:fireware::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
References	~~() https://psirt.watchguard.com/CVE-2026-18145 -~~	() https://psirt.watchguard.com/CVE-2026-18145 - Patch, Vendor Advisory

30 Sep 2026, 00:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 00:16

Updated : 2026-10-08 19:48

NVD link : CVE-2026-18145

Mitre link : CVE-2026-18145

CVE.ORG link : CVE-2026-18145

JSON object : View

Products Affected

watchguard

fireware

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-18145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-30T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "affectedData": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2026.3", "lessThan": "2026.3.2", "versionType": "custom"}, {"status": "affected", "version": "2025.0", "lessThan": "2026.2.3", "versionType": "custom"}, {"status": "affected", "version": "12.0", "lessThan": "12.12.3", "versionType": "custom"}], "platforms": ["Default"], "defaultStatus": "unaffected"}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "lessThan": "12.5.21", "versionType": "custom"}], "platforms": ["T15/T35"], "defaultStatus": "unaffected"}]}], "published": "2026-09-30T00:16:36.003", "references": [{"url": "https://psirt.watchguard.com/CVE-2026-18145", "tags": ["Patch", "Vendor Advisory"], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request."}], "lastModified": "2026-10-08T19:48:38.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C618D05C-B8A0-4912-B87E-B67A0686C14D", "versionEndExcluding": "12.5.21", "versionStartIncluding": "12.0"}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "684B81A6-0CE5-4424-A38A-FE989C790E7F", "versionEndExcluding": "12.12.3", "versionStartIncluding": "12.12"}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39259735-5AB8-48A4-9886-7C469DD3F469", "versionEndExcluding": "2026.2.3", "versionStartIncluding": "2025.2"}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "525833A2-ABEC-4C06-BE1B-6A5E64A21775", "versionEndExcluding": "2026.3.2", "versionStartIncluding": "2026.3"}], "operator": "OR"}]}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}