CVE-2026-13046: Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution
Published Sep 29, 2026
·Updated
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.11.10
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need before this can be exploited?
The attacker must already be able to write files on the Fireware OS appliance. They then need to place a maliciously crafted SAML session file where the samld service will load it.
2
What privileges would successful exploitation provide?
Successful exploitation allows arbitrary code execution in the context of the samld service.