Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-90441

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WatchGuard

Description

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WatchGuard Fireware OS

Default version status: unaffected

  • 2026.3 to < 2026.3.2affected
  • 2025.0 to < 2026.2.3affected
  • 12.0 to < 12.12.3affected

WatchGuard Fireware OS

Default version status: unaffected

  • 12.0 to < 12.5.21affected

References