CVE-2026-86101

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2026.3, < 2026.3.2; >= 2025.0, < 2026.2.3; >= 12.0, < 12.12.3
WatchGuard	Fireware OS	>= 12.0, < 12.5.21

References

https://psirt.watchguard.com/CVE-2026-86101Patch, Vendor Advisory

Timeline

Published: Sep 30, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-861029.3An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute CVE-2026-861047.5An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to c CVE-2026-861057.1An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal u CVE-2026-861069.6An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. Th CVE-2026-861075.9The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated over CVE-2026-861088.0Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized ma CVE-2026-861096.6The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does CVE-2026-86114.3The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including CVE-2026-861116.5BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read f CVE-2026-861125.4BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers CVE-2026-861136.5BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to mo CVE-2026-861146.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delet