CVE-2026-86101: Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
Published Sep 29, 2026
·Updated
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.5.21
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Remediation
Information
Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21
Patch Available
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which users can exploit this issue?
A remote user who can authenticate through SAML and is authorized only for the Access Portal can exploit it. The issue can grant that user Mobile VPN with SSL access beyond their intended authorization.
2
What access does an attacker need before exploitation?
The attacker must already be an authenticated SAML user with Access Portal access. Exploitation requires sending a specially crafted request.