CVE-2026-4266: WatchGuard Firebox Insecure Deserialization in Fireware Access Portal
An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.This issue affects Fireware OS: 12.1 through 12.11.8 and 2025.1 through 2026.1.2.
Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T-15 and T-35.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4266?
CVE-2026-4266 is categorized as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-4266?
To mitigate CVE-2026-4266, update WatchGuard Fireware OS to the latest version where the vulnerability is patched.
Who is affected by CVE-2026-4266?
Users of WatchGuard Fireware OS between versions 12.1 to 12.11.8 and 2025.1 to 2026.1.2 are affected by CVE-2026-4266.
What type of vulnerability is CVE-2026-4266?
CVE-2026-4266 is an insecure deserialization vulnerability that allows unauthorized code execution.
Is CVE-2026-4266 exploitable remotely?
CVE-2026-4266 may be exploited locally if an attacker has previously gained write access to the filesystem.