CVE-2026-90441

HighCVSS 8.1/10Last modified Oct 6, 2026

Description

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-200 CWE-400 CWE-862

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2026.3, < 2026.3.2; >= 2025.0, < 2026.2.3; >= 12.0, < 12.12.3
WatchGuard	Fireware OS	>= 12.0, < 12.5.21

References

https://psirt.watchguard.com/CVE-2026-90441Patch, Vendor Advisory

Timeline

Published: Sep 30, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-904428.6A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox man CVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no CVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An CVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted CVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli CVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr CVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo CVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role re CVE-2026-904515.9An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled CVE-2026-904525.3Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify t