Which versions of WatchGuard Fireware OS are affected by CVE-2026-13046?

A high-severity flaw in WatchGuard Fireware OS allows code to run inside the appliance's SAML single sign-on session service (samld), which sits on the perimeter of the network for organizations…. A patch is available.

How to fix or mitigate CVE-2026-13046?

Within 24 hours, confirm which WatchGuard Fireware OS appliances are in production and whether any local or remote administrative accounts beyond a tightly held break-glass set exist, then inventory and remove stale or shared admin credentials and enforce multi-factor authentication on all management access; also verify that management interfaces (HTTPS/SSH) are not reachable from untrusted networks. Within 7 days, open a tracked case with WatchGuard support to obtain the current fixed firmware build once released and subscribe to the vendor security advisory channel for CVE-2026-13046, and in the meantime restrict file-write paths on the appliance to the minimum set of administrators, review configuration and audit logs for unexpected file uploads or samld service restarts, and forward appliance logs to the SIEM with alerting on privileged authentication and service crashes. Within 30 days, schedule and test the vendor-released firmware upgrade during a maintenance window, revalidate that no compensating access restrictions were silently reverted by the upgrade, and confirm through a post-change audit that privileged administrative accounts on these appliances are still least-privilege, unique, and MFA-protected.

WatchGuard Fireware OS CVE-2026-13046

Q: What is the CVSS score of CVE-2026-13046?

CVE-2026-13046 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-89498 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-09-29 WatchGuard

GHSA-4m89-w9gx-fh8p

RCE Deserialization Fireware Os Watchguard

7.5

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (WatchGuard) · only source for this CVE.

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 30, 2026 - 02:01 EUVD

Analysis Generated

Sep 29, 2026 - 23:54 vuln.today

CVE Published

Sep 29, 2026 - 23:05 cve.org

HIGH 7.5

DescriptionCVE.org

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

AnalysisAI

Arbitrary code execution in WatchGuard Fireware OS is possible through its SAML single sign-on session daemon (samld), which deserializes session files it is asked to load without adequately validating their contents. The attacker must already be authenticated with high privileges (CVSS 4.0 vector PR:H) and must already be able to write files on the appliance, since the vector's AT:P metric and the description both indicate a required prior condition - this is a second-stage, post-foothold vulnerability rather than a standalone remote compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Vulnerability AssessmentAI

Risk Assessment

This is a genuine but strictly second-stage vulnerability, not a standalone remote compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.

Remediation

The intelligence supplied does not include a fixed version or a patch reference, so no vendor-released patch can be cited here; patch status must be confirmed directly from the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-13046 before planning upgrades, and any fix version should be taken from that source rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm which WatchGuard Fireware OS appliances are in production and whether any local or remote administrative accounts beyond a tightly held break-glass set exist, then inventory and remove stale or shared admin credentials and enforce multi-factor authentication on all management access; also verify that management interfaces (HTTPS/SSH) are not reachable from untrusted networks. …

Threat intelligence, references, and detailed analysis are available after sign-in.