CVE-2026-86101: Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access

Published Sep 29, 2026

Updated

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

Affected Software

1 affected component

WatchGuard Fireware OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.3.2
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.2.3
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.3
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.21

Event History

Sep 29, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

RemedyDescriptionWeakness

Sep 30, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

A remote user who can authenticate through SAML and is authorized only for the Access Portal can exploit it. The issue can grant that user Mobile VPN with SSL access beyond their intended authorization.

What access does an attacker need before exploitation?

The attacker must already be an authenticated SAML user with Access Portal access. Exploitation requires sending a specially crafted request.