WatchGuard Fireware OS CVE-2026-82332

Exploitation requires: (1) local access to the WatchGuard Fireware OS appliance (AV:L); (2) the AuthPoint multi-factor authentication process to be in use; (3) a victim user with an authentication already in progress - the attack cannot be launched at will (AT:P); and (4) active deception of that victim so they accept an attacker-triggered MFA push notification (UI:A). These same requirements are the limiting factors: the attacker must already be local on the device, must time the crafted request against a live victim MFA session, and must succeed at social-engineering the victim into approving the push. Exploitation is scoped to deployments where AuthPoint MFA is configured on affected Fireware OS versions (12.7 up to 12.12.4, and 2025.1 up to 2026.4).

This is a genuinely medium-tier issue rather than a drop-everything emergency, and the multi-source signals are consistent on that. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:A) scores 5.7: exploitation is unauthenticated (PR:N) but requires LOCAL access to the appliance (AV:L), a specific precondition that an attacker cannot control (AT:P - a victim must have an MFA authentication already in progress), and active participation from the victim (UI:A - the victim must accept the push notification). The impact is skewed toward confidentiality (VC:H) with only limited integrity impact (VI:L) and no availability impact, consistent with session hijacking that lets the attacker authenticate as the victim rather than destroy or disrupt the system. No EPSS score, KEV listing, or PoC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation-related signal is the vendor's own 'this_month' priority label, which aligns with scheduled patching rather than emergency response. The one tension worth flagging: the combination of a local attack vector plus required social engineering of the victim makes real-world exploitation operationally awkward, which argues the effective risk is lower than a raw reading of 'unauthenticated MFA bypass' might suggest - treat it as a routine-but-real patch, not a high-urgency network-exploitable flaw.

An attacker with local access to the WatchGuard appliance waits for (or induces) a legitimate user to begin an AuthPoint MFA login, then submits a specially crafted request that binds to the victim's in-progress authentication session. The attacker then convinces the victim to approve the resulting MFA push notification, at which point the attacker's session is authenticated as the victim. No public exploit code is identified at time of analysis, and success depends on precise timing against a live victim session plus the victim's cooperation in accepting the push.