EUVD-2026-17079Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (WatchGuard) · only source for this CVE.
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.This issue affects Fireware OS: 12.1 through 12.11.8 and 2025.1 through 2026.1.2.
Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T-15 and T-35.
AnalysisAI
Insecure deserialization in WatchGuard Fireware OS enables local code execution as the portald user when combined with a filesystem write primitive. Affects Fireware OS versions 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on platforms supporting Access Portal (excludes T-15/T-35 models). CVSS 8.4 severity reflects high impact but requires prior high-privilege local access and an existing write vulnerability to exploit. No public exploit identified at time of analysis, with EPSS data unavailable for risk probability assessment.
Technical ContextAI
This vulnerability exploits CWE-502 (Deserialization of Untrusted Data) in the Access Portal component of WatchGuard Fireware OS. Insecure deserialization occurs when applications deserialize data from untrusted sources without proper validation, allowing attackers to instantiate arbitrary objects and execute malicious code during the deserialization process. The portald user context suggests this affects the portal daemon service responsible for WatchGuard's Access Portal feature, which provides SSL VPN and web-based authentication capabilities. The CPE identifier cpe:2.3:a:watchguard:fireware_os confirms this is a software vulnerability in the operating system layer. The attack chain requires two prerequisites: an attacker must already possess high-privilege local access (PR:H in CVSS vector) and leverage a separate vulnerability to gain filesystem write capability, making this a vulnerability chaining scenario rather than a standalone attack surface.
RemediationAI
Organizations should immediately review the WatchGuard security advisory WGSA-2026-00007 available at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007 for specific patching instructions and fixed versions. Vendor-released patch details and exact remediation versions should be obtained directly from this advisory, as specific fixed version numbers are not included in the current CVE data. As an interim risk mitigation measure, organizations should audit and restrict high-privilege local access to WatchGuard appliances, implement enhanced monitoring for unusual portald process activity, and review filesystem access controls to minimize the attack surface for the prerequisite write vulnerability. Organizations operating T-15 or T-35 models can confirm they are not affected by this specific issue. Prioritize patching for internet-facing appliances and those in high-security environments where privilege escalation paths pose elevated risk.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today