What broke. Three critical bugs (CVSS 9.2 each) need no login. A stack buffer overflow in the SIP proxy, which handles internet phone calls through the firewall, lets an attacker run code by sending a crafted request through any policy that uses it (CVE-2026-93857). An integer overflow in Access Portal's WebSocket handling lets an attacker write past a memory buffer when Access Portal is turned on (CVE-2026-93866). And the FireCluster sync daemon, which keeps paired firewalls in step, skips authentication, so anyone who can reach the cluster management IP can trigger privileged actions (CVE-2026-93865).
The ones that need a foothold. Other critical bugs need the attacker to sit in the middle of traffic first: two heap overflows in the Active Directory login service (9.2), a logging-service overflow via a fake log server certificate that ends in root (9.1), and a WireGuard configuration overflow reachable by someone between the Firebox and WatchGuard Cloud (9.5). The rest cover FireCluster privilege escalation and crashes, a blind config-secret leak through SSH login, an AuthPoint MFA session hijack and root file tampering. No attacks in the wild have been reported so far.
What I'd do today. Firewalls are the front door, so patch to 2026.4 or 12.12.4 first on any Firebox with the SIP proxy in a policy or Access Portal exposed. If you can't patch tonight, take those features out of internet-facing policies and make sure the FireCluster management IP is unreachable from anywhere untrusted.