Vulnerability · Published Mar 30, 2026 · Assigned by WatchGuard

CVE-2026-4266WatchGuard Firebox Insecure Deserialization in Fireware Access Portal

High 8.4

In plain English

A high-severity unsafe deserialization in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	Fireware OS	2025.1 – before 2026.212.1 – before 12.12
WatchGuard	Fireware OS	12.1 – before 12.11.9

Weakness: CWE-502 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://psirt.watchguard.com/CVE-2026-4266 vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00007 vendor-advisory