CVE-2026-86105 is a high severity authorization flaw in the Fireware OS Access Portal reverse proxy. A logged in, low privileged user can reach web applications they are not authorized for by sending a crafted request for a resource they may access. WatchGuard rates it Medium. Upgrade to a fixed Fireware OS release.
What's affected
- Product: WatchGuard Fireware OS.
- Affected (WatchGuard PSIRT): Fireware OS 2026.3 before 2026.3.2; 2025.0 up to before 2026.2.3; and 12.0 before 12.12.3. T15 and T35 models: 12.0 before 12.5.21.
- Fixed: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 for T15 and T35.
- Exploitation: WatchGuard says it is not aware of any exploitation in the wild. The record's KEV flag is also false.
Severity in the record: High, CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The record scores it 7.1 (High) under CVSS v3.1. WatchGuard rates it Medium, 5.3 under CVSS v4. The difference matters when you set priority.
Weakness class: CWE-176 (Improper Handling of Unicode Encoding) CWE-22 (Path Traversal) CWE-285 (Improper Authorization).
How to check if you're exposed
- Find the Fireware OS version on the Firebox, for example on the system status page of the Web UI, or in WatchGuard's management tools.
- Match it to the affected ranges above. Note that the affected range depends on the release family and the model.
- Review Access Portal logs for users requesting applications outside their assigned group, especially with unusual encoded paths.
- Check whether the management or portal services face the internet, since that decides who can reach them.
What to do now
- Upgrade to the fixed Fireware OS release for your family: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35.
- Take a configuration backup before upgrading, and schedule a maintenance window.
- Review Access Portal resource assignments, and remove applications users do not need.
- Check internal applications published through the portal for their own authentication, so the proxy is not the only gate.
- Subscribe to WatchGuard PSIRT advisories so future fixes reach you quickly.
Why it matters
The weakness list pairs CWE-285 (improper authorization) with CWE-22 (path traversal) and CWE-176 (improper handling of Unicode encoding). WatchGuard lists related attack patterns for slashes and URL encoding used together to bypass validation. In plain terms, the proxy checks a path one way and forwards it another.
Reverse proxy access control only works if the proxy and the backend agree on what a path means. A user who is allowed to reach one application should not be able to reach another, so applications behind the portal should still check who is calling. WatchGuard and the record both say exploitation in the wild is not known.
Quick check
Why do the severity ratings differ?
The record uses CVSS v3.1 and gives 7.1. WatchGuard uses CVSS v4 and gives 5.3, with a different view of impact. Both agree it needs a logged in user.
Sources
Last reviewed: 18 October 2026.
