CVE-2026-93857

A crafted request through a SIP proxy policy can let an unauthenticated remote attacker run arbitrary code. The WatchGuard CNA lists a stack-based buffer overflow, unchecked buffer copying, and an out-of-bounds write among the weakness types.

The required configuration matters as much as the version. WatchGuard states that a SIP proxy must be configured on the Firebox. This record must not be read as a claim that all Fireboxes or all Fireware policies are exposed.

WatchGuard published its advisory on October 27, 2026. It says it is not aware of exploitation in the wild. That statement is attributed to the vendor; exploitation status remains unknown here. A technical severity rating does not establish that a compromise occurred.

For the default modern release track, WatchGuard lists Fireware versions from 2025.1 up to, but not including, 2026.4 as affected. The fixed release is 2026.4.

For the default 12.x track, the affected range starts at 12.0 and ends before 12.12.4. The fixed release is 12.12.4.

For T15 and T35 devices, the affected range starts at 12.0 and ends before 12.5.22. The fixed release is 12.5.22. This device-specific row should not be replaced with the default 12.x threshold.

All these version checks retain the SIP proxy configuration requirement. Record the Firebox model, active policy and running build before selecting the fix.

Use the WatchGuard SIP proxy patch checklist for the policy-to-verification workflow. The remote code execution glossary explains the impact, while our patch management entry covers rollout and verification.

The CVE was absent from CISA KEV catalog version 2026.10.28, fetched on October 29, 2026. That dated catalog fact does not prove that attacks cannot occur.