Vulnerability · Published Oct 27, 2026 · Assigned by WatchGuard

CVE-2026-82332Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

Medium 5.6

In plain English

A medium-severity improper authentication in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)5.6Medium

Exploit odds (30 days)0.1%top 98.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	Fireware OS	2025.1 – before 2026.412.7 – before 12.12.4

Weakness: CWE-287, CWE-346 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://psirt.watchguard.com/CVE-2026-82332 vendor-advisory