CVE-2026-18145 is a high severity (CVSS 3.1 score 7.2) stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS. An authenticated administrator can crash the service or possibly run code. WatchGuard fixed it in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and, for T15 and T35 appliances, 12.5.21.
What's affected
WatchGuard's advisory lists these Fireware OS ranges as affected:
- 2026.3 up to but not including 2026.3.2
- 2025.0 up to but not including 2026.2.3
- 12.0 up to but not including 12.12.3
- T15 and T35 models: 12.0 up to but not including 12.5.21
Fixed releases are 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 (the last one for T15 and T35). The NVD record describes the issue as requiring an authenticated attacker with administrator privileges, who sends a specially crafted management request.
The advisory states that WatchGuard is not aware of any exploitation in the wild, and the record's KEV flag is false.
How to check if you're exposed
Start with the Fireware OS version on each appliance. In Fireware Web UI, the version is shown on the System Status page. From the CLI, the show version style status commands on the appliance report the same information. If you manage many boxes through WatchGuard Cloud or WatchGuard System Manager, use the inventory view there to list OS versions in one place.
Then compare each version against the ranges above. Note that T15 and T35 follow a separate fixed release (12.5.21), so check the model before you decide which target applies.
The flaw sits behind the management interface, so also review who can reach it. List the source addresses allowed to administer each firewall and confirm the management interface is not exposed to the internet.
What to do now
- Inventory every Fireware appliance and record its model and OS version.
- Schedule an upgrade to the fixed release for your branch: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35.
- Back up the configuration before the upgrade, and plan a maintenance window because the appliance restarts.
- Restrict management access to a small set of trusted addresses and remove any internet facing administration rules.
- Review administrator accounts, remove any that are unused, and make sure each remaining account uses strong authentication.
- After upgrading, confirm the new version in the status page and record it in your asset list.
Why it matters
The weakness class is CWE-121, a stack-based buffer overflow. Input to the management request handler is copied into a fixed size buffer on the stack without a proper size check, so a crafted request can overwrite adjacent memory. The mildest outcome is a crash of the spamd service. The advisory and record also allow for code execution, which is why the confidentiality, integrity and availability impacts are all rated high.
The score is held down by the requirement for administrator privileges. That is a real barrier, but administrator credentials on edge devices do get stolen or reused, and a firewall is a high value place to run attacker code. WatchGuard also publishes a CVSS 4.0 score of 8.6 for the same flaw, higher than the 7.2 under CVSS 3.1 in the record. Both describe the same issue, and the version 4.0 figure reflects a different scoring method. The advisory lists no workaround, so upgrading is the fix.
Quick check
Does this need a valid administrator login?
Yes. The record and the advisory both describe an authenticated attacker with administrator privileges. That lowers the score but does not remove the need to patch, since admin credentials can leak.
Is there a workaround if I cannot upgrade right away?
WatchGuard lists none. Limit management access to trusted addresses as a temporary risk reduction and plan the upgrade.
Sources
Last reviewed: 18 October 2026.
