Live › vulnerability › CVE-2026-90464
Go to dashboardA WatchGuard Fireware OS firewall diagnostic command does not validate file paths, so an attacker with read-only Device Monitor access to the management CLI can create, truncate or overwrite arbitrary files. The same flaw lets them change kernel parameters with root privileges, though written content is limited to numeric values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Any WatchGuard Firebox running an affected Fireware OS where a user, even a read-only Device Monitor account, can reach the management CLI. An attacker with such an account can overwrite files and change kernel parameters as root, with numeric-only content. Teams where only trusted admins have CLI access are lower risk; fixed versions are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fireware OS | vendor | >= 2025.1, < 2026.4; >= 12.0, < 12.12.4; T15/T35 >= 12.0, < 12.5.22 | 2026.4, 12.12.4, 12.5.22 (T15/T35) |
show version)12.12.4, or T15/T35 >= 12.0 and < 12.5.22Upgrade Fireware OS to 2026.4 or later (2025.1/2026.x branch), 12.12.4 or later (12.x), or 12.5.22 or later (T15/T35 models).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
This page as .md · .json · in your agent: get_signal("CVE-2026-90464")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.