---
id: CVE-2026-13046
title: >-
  A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's
  SAML single sign-on session handling (samld) allows an attacker who has
  already obtained the ability to write files on the appliance to execute
  arbitrary code …
summary: >-
  A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's
  SAML single sign-on session handling (samld) allows an attacker who has
  already obtained the ability to write files on the appliance to execute
  arbitrary code …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: watchguard
product: fireware
affected:
  - 'fireware >= 12.0, < 12.11.10'
  - 'fireware >= 12.12, < 12.12.3'
  - 'fireware >= 2025.0, < 2026.2.3'
  - 'fireware >= 2026.3, < 2026.3.2'
patched:
  - fireware 2026.3.2
published: '2026-09-30'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:01:01.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13046'
references:
  - url: 'https://psirt.watchguard.com/CVE-2026-13046'
    label: 5d1c2695-1a31-4499-88ae-e847036fd7e3
tags:
  - nvd
  - cve.org
epss: 0.00369
epssPercentile: 0.30685
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-30T14:23:22.131042Z'
scores:
  nvd: 7.2
  cna: 7.5
ingestedAt: '2026-09-29T23:52:50.543Z'
---

## Overview

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

## Affected

- `fireware >= 12.0, < 12.11.10`
- `fireware >= 12.12, < 12.12.3`
- `fireware >= 2025.0, < 2026.2.3`
- `fireware >= 2026.3, < 2026.3.2`

## Remediation

Upgrade past the affected range:

- `fireware 2026.3.2`