---
id: "CVE-2026-90464"
kind: "vulnerability"
aliases: ["CVE-2026-90464"]
title: "WatchGuard Fireware OS: authenticated CLI command lets attacker write root-level files"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Fireware OS", "fixed": ["2026.4", "12.12.4", "12.5.22 (T15/T35)"], "affected": ">= 2025.1, < 2026.4; >= 12.0, < 12.12.4; T15/T35 >= 12.0, < 12.5.22", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firewall", "fireware-os", "infrastructure", "network-appliance", "self-hosted", "watchguard"]
not_affected_if: ["auth-required", "fixed-version"]
published_at: "2026-10-27T16:17:31+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:36:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90464", "first_seen_at": "2026-10-27T16:33:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T16:36:54+00:00"}]
---

# WatchGuard Fireware OS: authenticated CLI command lets attacker write root-level files

A WatchGuard Fireware OS firewall diagnostic command does not validate file paths, so an attacker with read-only Device Monitor access to the management CLI can create, truncate or overwrite arbitrary files. The same flaw lets them change kernel parameters with root privileges, though written content is limited to numeric values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fireware OS affected >= 2025.1, < 2026.4; >= 12.0, < 12.12.4; T15/T35 >= 12.0, < 12.5.22 fixed 2026.4, 12.12.4, 12.5.22 (T15/T35)

## How to check

In Fireware Web UI or CLI, check the running version (System Status / 'show version'). Exposed if it is >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4, or T15/T35 >= 12.0 and < 12.5.22. Also list which accounts (including read-only Device Monitor) have management CLI access.

## Fix

Upgrade Fireware OS to 2026.4 or later (2025.1/2026.x branch), 12.12.4 or later (12.x), or 12.5.22 or later (T15/T35 models).

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90464
- 2026-10-27T16:36:54+00:00 analyst — WatchGuard PSIRT index lists CVE-2026-90464 (CVSS 7.2) with affected/fixed ranges; per-advisory page not retrievable, so diagnostic command name unknown and nothing marked verified. No exploitation or PoC found (not searched socially).

## Documents

- [advisory] WatchGuard Security Advisories (CVE-2026-90464 row) https://psirt.watchguard.com/

## From the sources

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_