CVE 2026 13046

psirt.watchguard.com • September 30, 2026

Share: View original

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

Weakness Type and Impact #

CWE CWE-502 Deserialization of Untrusted Data

CAPEC CAPEC-586 Object Injection

Exploitation Status #

Nicholas Zubrisky (@NZubrisky) of TrendAI Research finder

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerability in WatchGuard FireWare OS A remote code execution vulnerability has been identified in WatchGuard FireWare OS affecting its samld SAML session handling. Attackers who can write to the samld session directory can exploit this flaw, which arises from improper validation of user-supplied data leading to deserialization of untrusted data. The vulnerability has been assigned CVE-2026-13046, and WatchGuard has released an update to mitigate the issue. The advisory was publicly released on September 30, 2026, following a report to the vendor on May 22, 2026. The flaw allows attackers to execute arbitrary code in the context of the samld service, potentially leading to significant security breaches. Users are advised to apply the available patches immediately to protect their systems. 2 sources 57

Extracted Entities

CWE Weaknesses (1)

Cwe-502 - Deserialization Of Untrusted Data

Domains (1)

Platforms (1)

WatchGuard Fireware OS

Vulnerabilities (1)

Deserialization Of Untrusted Data