CVE-2026-13046 — Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

CVE-2026-13046

Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution PUBLISHED

Description (CNA)

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

Affected (CNA)

Vendor / product	Versions
WatchGuard / Fireware OS	affected 2026.3 before 2026.3.2; affected 2025.0 before 2026.2.3; affected 12.0 before 12.12.3
WatchGuard / Fireware OS	affected 12.11 before 12.11.10

CWE

CWE-502

References

https://psirt.watchguard.com/CVE-2026-13046

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.