CVE-2026-13046
published 2026-09-30CVE-2026-13046: A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already…
PriorityP347high7.5CVSS 4.0
AVNACLATPPRHUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.32%
23.4th percentile
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| watchguard | fireware_os | >= 12.0 < 12.12.3 | 12.12.3 |
| watchguard | fireware_os | >= 12.11 < 12.11.10 | 12.11.10 |
| watchguard | fireware_os | >= 2025.0 < 2026.2.3 | 2026.2.3 |
| watchguard | fireware_os | >= 2026.3 < 2026.3.2 | 2026.3.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WatchGuard Fireware OS SAML Single Sign-On Session deserialization
vuldb·2026-09-30·CVSS 7.5
CVE-2026-13046 [HIGH] WatchGuard Fireware OS SAML Single Sign-On Session deserialization
A vulnerability labeled as very critical has been found in WatchGuard Fireware OS. Impacted is an unknown function of the component SAML Single Sign-On Session Handler. The manipulation results in deserialization.
This vulnerability is cataloged as CVE-2026-13046. The attack must be initiated from a local position. There is no exploit available.
GHSA
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the
ghsa_unreviewed·2026-09-30
CVE-2026-13046 [HIGH] CWE-502 A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-30
Published