CVE-2026-13046 is a high severity deserialization flaw in WatchGuard Fireware OS. The SAML single sign-on service (samld) can load a crafted session file, giving code execution to an attacker who can already write files on the appliance. Fixed in 2026.3.2, 2026.2.3, 12.12.3 and 12.11.10.
What's affected
- Fireware OS Default: 2026.3 before 2026.3.2; 2025.0 before 2026.2.3; 12.0 before 12.12.3.
- Fireware OS EUCC: 12.11 before 12.11.10.
- Fixed: 2026.3.2, 2026.2.3, 12.12.3, and 12.11.10 for the EUCC line.
- Workaround: none listed. WatchGuard's stated solution is upgrading.
Source conflict on severity: the CVE record scores this 7.2 High (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). WatchGuard rates it High with a CVSS 4.0 base score of 7.5. Both are High.
How to check if you're exposed
Check the Fireware OS version in the appliance web interface or from the command line, then match it to the ranges above.
Use the system status page of the web interface, or WatchGuard's management tooling, to read the version. Also check whether SAML single sign-on is configured, because the vulnerable component is the SAML session handling.
What to do now
- Record the Fireware version on every appliance and whether SAML SSO is in use.
- Upgrade to the fixed release for your line, from the list above.
- Restrict administrative access to the appliance, since an attacker needs file write ability first.
- Review how the device is managed, and who holds credentials that could write files to it.
Why it matters
The weakness is CWE-502 (Deserialization of Untrusted Data). A session file is read back and turned into objects. If an attacker can plant a file, the loader can be made to run attacker chosen behavior in the context of the samld service.
The precondition matters: the attacker must already be able to write files on the appliance, which is why the score stays at High and not Critical. It still deserves a patch, since a second flaw that gives file write could chain into code execution on a perimeter device. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Perimeter appliances are easy to leave on old firmware, because upgrades mean a maintenance window and sometimes a brief outage. Put the four fixed release lines in your tracker, note which one each appliance follows, and schedule the upgrade with a rollback plan.
Quick check
Does this need existing access?
Yes. The attacker must already be able to write files on the appliance.
Is there a workaround?
None is listed. Upgrade.
Sources
Last reviewed: 18 October 2026.
