EUVD-2026-89499
GHSA-jrch-5qv6-q7m4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv SAML user (PR:L), remote and low-complexity; authorization bypass crosses into VPN/internal scope (S:C) yielding high confidentiality (C:H), limited integrity, no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
AnalysisAI
Improper authorization in WatchGuard Fireware OS's SAML login flow lets an authenticated SAML user who is scoped only to the Access Portal obtain unauthorized Mobile VPN with SSL access by submitting a specially crafted login request. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) confirms this is a bounded privilege-escalation issue: the attacker must already hold a valid low-privilege SAML account, SAML authentication must be configured, the Access Portal must be exposed, and Mobile VPN with SSL must be provisioned (PR:L, AT:P), with no user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) SAML authentication configured on Fireware OS; (2) the WatchGuard Access Portal enabled and exposed; (3) Mobile VPN with SSL provisioned on the appliance; and (4) the attacker already holding a valid SAML user account scoped to Access-Portal-only access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded authorization/privilege-escalation issue, not a raw-critical drive-by. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fix version is identified in the provided data, so the primary action is to obtain the corrected Fireware OS release and guidance from the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-86101 and apply it as soon as a fixed build is designated for your branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WatchGuard Fireware OS instance, confirm which run SAML authentication and which have Mobile VPN with SSL provisioned, and disable Mobile VPN with SSL wherever it is not operationally required; where it is required, restrict Access Portal exposure to trusted source IP ranges or geographies, review SAML group and role mappings for overly broad Access Portal scopes, and enable detailed logging of SAML assertions and SSL VPN session establishment so that a portal-scoped user obtaining a VPN tunnel can be detected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today