{"api_version":"1","generated_at":"2026-10-23T09:02:13+00:00","cve":"CVE-2026-18145","urls":{"html":"https://cve.report/CVE-2026-18145","api":"https://cve.report/api/cve/CVE-2026-18145.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-18145","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-18145"},"summary":{"title":"Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution","description":"A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.","state":"PUBLISHED","assigner":"WatchGuard","published_at":"2026-09-30 00:16:36","updated_at":"2026-10-08 19:48:38"},"problem_types":["CWE-121","CWE-121 CWE-121"],"metrics":[{"version":"4.0","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"8.6","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}},{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-18145","name":"https://psirt.watchguard.com/CVE-2026-18145","refsource":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18145","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18145","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 2026.3 2026.3.2 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 2025.0 2026.2.3 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 12.0 12.12.3 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 12.0 12.5.21 custom","platforms":["T15/T35"]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21","time":"","lang":"en"}],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild.","time":"","lang":"en"}],"credits":[{"source":"CNA","value":"Nicholas Zubrisky (@NZubrisky) of TrendAI Research","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"18145","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"watchguard","cpe5":"fireware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"18145","cve":"CVE-2026-18145","epss":"0.003420000","percentile":"0.253770000","score_date":"2026-10-04","updated_at":"2026-10-05 00:09:46"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-18145","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-30T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-01T03:55:40.898Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Default"],"product":"Fireware OS","vendor":"WatchGuard","versions":[{"lessThan":"2026.3.2","status":"affected","version":"2026.3","versionType":"custom"},{"lessThan":"2026.2.3","status":"affected","version":"2025.0","versionType":"custom"},{"lessThan":"12.12.3","status":"affected","version":"12.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["T15/T35"],"product":"Fireware OS","vendor":"WatchGuard","versions":[{"lessThan":"12.5.21","status":"affected","version":"12.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"12.5.21","versionStartIncluding":"12.0","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.3.2","versionStartIncluding":"2026.3","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.3","versionStartIncluding":"2025.0","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"12.12.3","versionStartIncluding":"12.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Nicholas Zubrisky (@NZubrisky) of TrendAI Research"}],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild."}],"value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild."}],"metrics":[{"cvssV4_0":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"CWE-121","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-29T23:05:47.947Z","orgId":"5d1c2695-1a31-4499-88ae-e847036fd7e3","shortName":"WatchGuard"},"references":[{"tags":["vendor-advisory"],"url":"https://psirt.watchguard.com/CVE-2026-18145"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"}],"value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"}],"title":"Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution"}},"cveMetadata":{"assignerOrgId":"5d1c2695-1a31-4499-88ae-e847036fd7e3","assignerShortName":"WatchGuard","cveId":"CVE-2026-18145","datePublished":"2026-09-29T23:05:47.947Z","dateReserved":"2026-07-28T18:56:32.068Z","dateUpdated":"2026-10-01T03:55:40.898Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-30 00:16:36","lastModifiedDate":"2026-10-08 19:48:38","problem_types":["CWE-121","CWE-121 CWE-121"],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-18145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.2","versionEndExcluding":"2026.2.3","matchCriteriaId":"39259735-5AB8-48A4-9886-7C469DD3F469"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"18145","Ordinal":"1","Title":"Fireware OS Stack-based Buffer Overflow in spamd Allows Remote C","CVE":"CVE-2026-18145","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"18145","Ordinal":"1","NoteData":"A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.","Type":"Description","Title":"Fireware OS Stack-based Buffer Overflow in spamd Allows Remote C"}]}}}