{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4266", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-03-16T12:50:10.806Z", "datePublished": "2026-03-30T12:38:01.593Z", "dateUpdated": "2026-08-10T16:39:49.547Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-10T16:39:49.547Z"}, "title": "WatchGuard Firebox Insecure Deserialization in Fireware Access Portal", "descriptions": [{"lang": "en", "value": "An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.\n\nNote, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35."}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.1", "versionType": "custom", "lessThan": "2026.2"}, {"status": "affected", "version": "12.1", "versionType": "custom", "lessThan": "12.12"}], "defaultStatus": "unaffected", "platforms": ["Default"]}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-4266", "tags": ["vendor-advisory"]}, {"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1", "versionEndExcluding": "2026.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1", "versionEndExcluding": "12.12"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.4, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502", "type": "CWE", "cweId": "CWE-502"}]}], "credits": [{"lang": "en", "value": "btaol", "type": "finder"}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2, Fireware OS 12.12"}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this issue in the wild."}], "datePublic": "2026-03-30T12:38:01.593Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-4266"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T03:55:35.825Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-30T13:19:48.660512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T13:19:52.252Z"}}], "cna": {"title": "WatchGuard Firebox Insecure Deserialization in Fireware Access Portal", "credits": [{"lang": "en", "type": "finder", "value": "btaol"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.1", "lessThan": "2026.2", "versionType": "custom"}, {"status": "affected", "version": "12.1", "lessThan": "12.12", "versionType": "custom"}], "platforms": ["Default"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this issue in the wild."}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2, Fireware OS 12.12"}], "datePublic": "2026-03-30T12:38:01.593Z", "references": [{"url": "https://psirt.watchguard.com/CVE-2026-4266", "tags": ["vendor-advisory"]}, {"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.\n\nNote, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.2", "versionStartIncluding": "2025.1"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.12", "versionStartIncluding": "12.1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-10T16:39:49.547Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4266", "state": "PUBLISHED", "dateUpdated": "2026-08-10T16:39:49.547Z", "dateReserved": "2026-03-16T12:50:10.806Z", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "datePublished": "2026-03-30T12:38:01.593Z", "assignerShortName": "WatchGuard"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThanOrEqual": "12.11.8", "status": "affected", "version": "12.1", "versionType": "semver"}, {"lessThanOrEqual": "2026.1.2", "status": "affected", "version": "2025.1", "versionType": "semver"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.This issue affects Fireware OS: 12.1 through 12.11.8 and 2025.1 through 2026.1.2.\n\nNote, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T-15 and T-35."}, {"lang": "es", "value": "Una vulnerabilidad de deserializaci\u00f3n insegura en WatchGuard Fireware OS permite a un atacante que ha obtenido acceso de escritura al sistema de archivos local a trav\u00e9s de otra vulnerabilidad ejecutar c\u00f3digo arbitrario en el contexto del usuario 'portald'. Este problema afecta a Fireware OS: 12.1 hasta 12.11.8 y 2025.1 hasta 2026.1.2.\n\nTenga en cuenta que esta vulnerabilidad no afecta a las plataformas Firebox que no admiten la funci\u00f3n Access Portal, incluyendo los T-15 y T-35."}], "id": "CVE-2026-4266", "lastModified": "2026-06-17T10:56:19.663", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4266", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-30T13:16:22.573", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1,12.11.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2025.1,2026.1.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Fireware OS", "source": "cna", "vendor": "WatchGuard"}, "product": "fireware_os", "vendor": "watchguard"}], "analysis": {"en": {"generated_at": "2026-03-30T15:05:27.311438+00:00", "value": {"mitigation_remediation": ["Apply the latest Fireware OS patch that removes the insecure deserialization bug (version 12.12 or newer and 2026.1.3 or newer).", "If the Access Portal feature is not required, disable it to eliminate the vulnerable code path.", "Restrict local file write permissions for untrusted users and monitor for any unauthorized modifications of the portal service files."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects Fireware OS releases 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on devices that support the Access Portal feature. Firebox models that do not implement Access Portal, such as the T\u201115 and T\u201135, are not impacted by this vulnerability.", "description_and_impact": "Insecure deserialization is present in the Fireware Access Portal component of WatchGuard Firebox Fireware OS. The flaw allows an attacker who has previously obtained write access to the local filesystem to construct a crafted serialized payload that is deserialized by the portal service, leading to arbitrary code execution in the context of the portald user. The vulnerability can be used to gain full control over the affected device, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 8.4 indicates a high severity level. While a specific EPSS value is not published, the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an initial foothold that provides local write privileges; once that condition is met, an attacker can trigger insecure deserialization to execute code. Consequently, systems that have not applied a patch or mitigated the prerequisite vulnerability face a high risk of compromise."}}}}, "created": "2026-03-30T20:55:45.761620+00:00", "updated": "2026-03-31T20:40:56.481810+00:00", "vendors": ["watchguard", "watchguard$PRODUCT$fireware_os"]}