WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability

September 30th, 2026
ZDI-26-749 ZDI-CAN-31456

CVE ID

CVE-2026-13046

CVSS Score

7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

WatchGuard

Affected Products

FireWare OS

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of session files in the samld service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the samld user.

Additional Details

WatchGuard has issued an update to correct this vulnerability. More details can be found at:
https://psirt.watchguard.com/CVE-2026-13046

Disclosure Timeline

  • 2026-05-22 - Vulnerability reported to vendor
  • 2026-09-30 - Coordinated public release of advisory
  • 2026-09-30 - Advisory Updated

Credit

Nicholas Zubrisky (@NZubrisky) of TrendAI Research

Back to Advisories