Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-13046

Watchguard Fireware: unsafe deserialisation can lead to remote code execution

Risk score
49/100
CVSS
7.2 v3.1
Exploit chance (30 days)
0.4%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted…
Affected
Watchguard Fireware
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Watchguard FirewareTHE FLAWSTHE FIXCVE-2026-13046Unsafe deserialisation can leadto remote code executionCVSS 7.2 · EPSS 0%CVE-2026-86131Code injectionCVSS 9.8 · EPSS 0%CVE-2026-86134Null pointer dereference canlead to denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-86104Denial of serviceCVSS 7.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedWatchguard FirewareAMBER · PATCH THIS WEEKWatchguardFirewareA code injection vulnerability inWatchGuard Fireware OS'sBOVPN Over TLS clientconfiguration handling allows anattacker who controls theremote VPN server to executearbitrary commands as root on…Where it standsNo known exploitationCONNECTS TOSame weaknessUnsafe deserialisation (CWE-502)250 other warnings in 30 days →Same productEarlier Watchguard Fireware warnings10 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Watchguard Fireware: Amber, patch this week. A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

The flaws

  • CVE-2026-13046: Unsafe deserialisation can lead to remote code execution (CVSS 7.2 · EPSS 0%)
  • CVE-2026-86131: Code injection (CVSS 9.8 · EPSS 0%)
  • CVE-2026-86134: Null pointer dereference can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-86104: Denial of service (CVSS 7.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Watchguard Fireware

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.2 high

References

Original description

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

Last activity 30 Sep 2026. Patch Forecast updates every hour.