CVE-2026-4266: WatchGuard Firebox Insecure Deserialization in Fireware Access Portal
An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.
Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 2026.2 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.12 - Compensating control
Verify the device is not a Firebox platform that does not support the Access Portal feature (e.g., T15 and T35), since the vulnerability does not affect those platforms.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4266?
CVE-2026-4266 is categorized as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-4266?
To mitigate CVE-2026-4266, update WatchGuard Fireware OS to the latest version where the vulnerability is patched.
Who is affected by CVE-2026-4266?
Users of WatchGuard Fireware OS between versions 12.1 to 12.11.8 and 2025.1 to 2026.1.2 are affected by CVE-2026-4266.
What type of vulnerability is CVE-2026-4266?
CVE-2026-4266 is an insecure deserialization vulnerability that allows unauthorized code execution.
Is CVE-2026-4266 exploitable remotely?
CVE-2026-4266 may be exploited locally if an attacker has previously gained write access to the filesystem.