CVE-2026-13046CWE-502insecure-deserialization

CVE-2026-13046

High · published September 30, 2026

CVSS v3.1

7.2

EPSS

Percentile

29.7

In the wild

Unconfirmed

What it is

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 7.5 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00369 · 29.7th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2026-09-30T04:16Z

Affected products (4)

Product	Versions	Fixed in
watchguard/fireware	≥ 12.0, < 12.11.10	12.11.10
watchguard/fireware	≥ 12.12, < 12.12.3	12.12.3
watchguard/fireware	≥ 2025.0, < 2026.2.3	2026.2.3
watchguard/fireware	≥ 2026.3, < 2026.3.2	2026.3.2

References (1)

https://psirt.watchguard.com/CVE-2026-13046 · 5d1c2695-1a31-4499-88ae-e847036fd7e3

EPSS history

Timeline

01 OCT 03:44Z
EPSS moved — → 0%
epss
29 SEP 23:05Z
Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution
cvelistv5