CVE-2026-4266CWE-502insecure-deserialization

CVE-2026-4266

Medium · published March 30, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.

Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-03-30T17:16Z
Affected products (2)
ProductVersionsFixed in
watchguard/fireware≥ 2025.1, < 2026.22026.2
watchguard/fireware≥ 12.1, < 12.1212.12
References (2)
https://psirt.watchguard.com/CVE-2026-4266 · 5d1c2695-1a31-4499-88ae-e847036fd7e3https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 30 MAR 12:38Z
    WatchGuard Firebox Insecure Deserialization in Fireware Access Portal
    cvelistv5