ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published Sep 30, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-13046.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 30, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What prerequisite does an attacker need before exploiting this issue?
The attacker must first be able to write to the samld session directory on the target system. The provided information does not identify how that write access could be obtained.
2
What is the potential impact after successful exploitation?
A remote attacker could execute arbitrary code on the affected WatchGuard FireWare OS installation.
3
How is this vulnerability tracked and rated?
It is assigned CVE-2026-13046. ZDI assigned it a CVSS rating of 7.5.