CVE-2026-104381

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.

CVSS 4.0

6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

CWEs

CWE-294, CWE-306, CWE-345

Published

2026-10-27

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

References

• https://psirt.watchguard.com/CVE-2026-104381

Check your stackJSON