CVE-2026-90465
CVE-2026-90465 · Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
CVSS 8.7 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
fireware os
- Versions
- ≥ 2025.1, < 2026.4: Affected (custom)
- ≥ 12.0, < 12.12.4: Affected (custom)
Update to 12.12.4; Update to 2026.4
fireware os
- Versions
- ≥ 12.0, < 12.5.22: Affected (custom)
Update to 12.5.22