CVE-2026-86105: Fireware OS Improper Authorization in Access Portal Reverse Proxy

Q: What level of access does an attacker need to exploit this issue?

The attacker must be authenticated to the Access Portal as a low-privileged user. The issue does not describe exploitation by an unauthenticated remote attacker.

Q: What could an attacker gain through successful exploitation?

A low-privileged Access Portal user could access other web applications that they are not authorized to use. Exploitation involves sending a specially crafted request for a different resource that the user is authorized to access.

Published Sep 29, 2026

Updated

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

Affected Software

5 affected components

WatchGuard Fireware OS

WatchGuard Fireware>=12.0<12.5.21

WatchGuard Fireware>=12.12<12.12.3

WatchGuard Fireware>=2025.0<2026.2.3

WatchGuard Fireware>=2026.3<2026.3.2

Event History

Sep 29, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

RemedyDescriptionWeakness

Sep 30, 2026

Data Sourced

via NVD·12:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be authenticated to the Access Portal as a low-privileged user. The issue does not describe exploitation by an unauthenticated remote attacker.

What could an attacker gain through successful exploitation?