ZDI-CAN-31456: ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published Sep 30, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-13046.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 30, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need before they can exploit this issue?
The attacker must first gain the ability to write to the samld session directory on the target system. The provided information does not identify how that write access could be obtained.
2
What is the potential impact after successful exploitation?
A successful attacker can execute arbitrary code on the affected WatchGuard FireWare OS installation.
3
How severe is this vulnerability rated?
ZDI assigned this issue a CVSS score of 7.5. The listed identifier is CVE-2026-13046.