PatchTheCVECVE-2026-4266: An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write
CVE-2026-4266 is a medium-severity flaw (CVSS 6.7) affecting fireware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.7 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 80%) |
| CISA exploited list | No |
| Weakness | CWE-502 |
| Published | 2026-03-30 |
| Last modified | 2026-08-28 |
Last updated 2026-08-28 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-4266?
fireware: upgrade to 12.12, 2026.2. Exact commands for each OS are on this page.
Is CVE-2026-4266 being exploited?
CVE-2026-4266 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-4266 affect?
CVE-2026-4266 affects fireware. Severity is medium (CVSS 6.7). An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note,
How urgent is CVE-2026-4266?
Priority 28/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-3987 HIGH 7.2 UPGRADE A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged
- CVE-2026-13368 HIGH 8.1 UPGRADE WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authenticat
- CVE-2026-13084 HIGH 7.5 UPGRADE A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker
- CVE-2026-13383 HIGH 7.2 UPGRADE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated p
- CVE-2026-13384 HIGH 7.2 UPGRADE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated pr