CVE-2026-86105
Received Received - Intake

Improper Authorization in Fireware OS Access Portal

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WatchGuard Technologies, Inc.

Description
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-86105
EUVD
EUVD-2026-89492

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
watchguard fireware_os From 12.0 (inc) to 2026.4 (exc)
watchguard fireware_os 2026.3.2
watchguard fireware_os 2026.2.3
watchguard fireware_os 12.12.3
watchguard fireware_os 12.5.21

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-176 The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization flaw in Fireware OS's Access Portal reverse proxy. An authenticated low-privileged user can bypass access controls by sending a specially crafted request to access web applications they are not authorized for. The issue involves path traversal and improper Unicode encoding handling.

Detection Guidance

Detecting this vulnerability requires checking Fireware OS versions for exposure. Verify if your system runs versions 2026.3, 2026.2, 2025.0, or 12.x without the latest patches. Inspect logs for unusual access patterns or unauthorized resource requests via the Access Portal.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive web applications or data. Low-privileged users might gain access to resources they should not be able to view or modify, potentially leading to data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to protected data, violating compliance requirements such as GDPR or HIPAA. Organizations using affected Fireware OS versions may face regulatory penalties, data exposure risks, and reputational damage if exploited.

Mitigation Strategies

Apply the latest patches immediately: upgrade to Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21. Restrict low-privileged user access to the Access Portal until patched. Monitor network traffic for suspicious requests targeting unauthorized resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart