File Path Control Vulnerability in WatchGuard Fireware OS Firewall
CVE-2026-90464

7.2HIGH

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
27 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-90464?

An external control of file path vulnerability exists in the WatchGuard Fireware OS firewall diagnostic command. This flaw allows a remote, authenticated attacker with read-only privileges access to the management CLI. By issuing a specially crafted command, an attacker could potentially create, truncate, or overwrite files and modify kernel parameters with elevated root privileges. The exploitation of this vulnerability is limited to commands that consist of numeric values, posing a risk of unauthorized access and system manipulation.

Affected Version(s)

Fireware OS Default 2025.1 < 2026.4

Fireware OS Default 12.0 < 12.12.4

Fireware OS T15/T35 12.0 < 12.5.22

References

https://psirt.watchguard.com/CVE-2026-90464
vendor-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WatchGuard AI Security Research
.