CVE-2026-90464

UNKNOWN 0.0

Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

CWE	CWE-59 CWE-73 CWE-732
Vendor	watchguard
Product	fireware os
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for watchguard fireware os

Be the first to know when new unknown vulnerabilities affecting watchguard fireware os are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

WatchGuard / Fireware OS

2025.1 < 2026.4 12.0 < 12.12.4

WatchGuard / Fireware OS

12.0 < 12.5.22

References

NVD ↗ CVE.org ↗ EPSS Data ↗

psirt.watchguard.com: https://psirt.watchguard.com/CVE-2026-90464

Credits

WatchGuard AI Security Research