Which versions of Fireware Os are affected by CVE-2026-4266?

WatchGuard Fireware OS contains an insecure deserialization vulnerability (CVE-2026-4266, CVSS 8.4) affecting gateway appliances running versions 12.1-12.11.8 and 2025.1-2026.1.2 with Access Portal…

How to fix or mitigate CVE-2026-4266?

Within 24 hours: Identify all WatchGuard Fireware OS appliances in your environment using affected versions (12.1-12.11.8, 2025.1-2026.1.2) and confirm Access Portal is enabled; document which models are T-15/T-35 (unaffected). Within 7 days: Restrict local administrative access and SSH/console access to WatchGuard appliances to authorized personnel only; disable unnecessary local accounts and apply principle of least privilege. Within 30 days: Contact WatchGuard for patch availability timeline; evaluate upgrading to versions beyond 12.11.8 or 2026.1.2 when patches are released; consider implementing network segmentation to limit lateral movement if a firewall is compromised.

Fireware Os CVE-2026-4266

Q: What is the CVSS score of CVE-2026-4266?

CVE-2026-4266 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17079 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-30 WatchGuard

Deserialization RCE Fireware Os Watchguard

8.4

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (WatchGuard) · only source for this CVE.

CVSS VectorVendor: WatchGuard

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 13:00 euvd

EUVD-2026-17079

Analysis Generated

Mar 30, 2026 - 13:00 vuln.today

CVE Published

Mar 30, 2026 - 12:38 nvd

HIGH 8.4

DescriptionCVE.org

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.This issue affects Fireware OS: 12.1 through 12.11.8 and 2025.1 through 2026.1.2.

Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T-15 and T-35.

AnalysisAI

Insecure deserialization in WatchGuard Fireware OS enables local code execution as the portald user when combined with a filesystem write primitive. Affects Fireware OS versions 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on platforms supporting Access Portal (excludes T-15/T-35 models). CVSS 8.4 severity reflects high impact but requires prior high-privilege local access and an existing write vulnerability to exploit. No public exploit identified at time of analysis, with EPSS data unavailable for risk probability assessment.

Technical ContextAI

This vulnerability exploits CWE-502 (Deserialization of Untrusted Data) in the Access Portal component of WatchGuard Fireware OS. Insecure deserialization occurs when applications deserialize data from untrusted sources without proper validation, allowing attackers to instantiate arbitrary objects and execute malicious code during the deserialization process. The portald user context suggests this affects the portal daemon service responsible for WatchGuard's Access Portal feature, which provides SSL VPN and web-based authentication capabilities. The CPE identifier cpe:2.3:a:watchguard:fireware_os confirms this is a software vulnerability in the operating system layer. The attack chain requires two prerequisites: an attacker must already possess high-privilege local access (PR:H in CVSS vector) and leverage a separate vulnerability to gain filesystem write capability, making this a vulnerability chaining scenario rather than a standalone attack surface.

RemediationAI

Organizations should immediately review the WatchGuard security advisory WGSA-2026-00007 available at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007 for specific patching instructions and fixed versions. Vendor-released patch details and exact remediation versions should be obtained directly from this advisory, as specific fixed version numbers are not included in the current CVE data. As an interim risk mitigation measure, organizations should audit and restrict high-privilege local access to WatchGuard appliances, implement enhanced monitoring for unusual portald process activity, and review filesystem access controls to minimize the attack surface for the prerequisite write vulnerability. Organizations operating T-15 or T-35 models can confirm they are not affected by this specific issue. Prioritize patching for internet-facing appliances and those in high-security environments where privilege escalation paths pose elevated risk.