CVE-2026-4266

MediumCVSS 6.7/10Last modified Aug 28, 2026

Description

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.

Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2026
Last modified
Aug 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-426606.5Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.CVE-2026-426618.8Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.CVE-2026-426626.5Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.CVE-2026-426636.5Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.CVE-2026-426648.2Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.CVE-2026-426659.3Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.CVE-2026-426667.5Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.CVE-2026-426677.5Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.CVE-2026-426687.5Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.CVE-2026-426697.5Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affecCVE-2026-42677.2The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_CVE-2026-426707.5Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Config
CVE-2026-4266: Medium severity, CVSS 6.7 | Vulnix