WatchGuard Fireware OS contains a bug in the SAML single sign‑on session handler (samld) that improperly deserializes untrusted data. A crafted session file can be loaded by samld, causing arbitrary code to run in the service’s context. The flaw requires that the attacker already be able to write files to the appliance, but once that condition is met the service will execute the payload with the privileges granted to samld. This allows the attacker to execute commands, modify configuration or install backdoors, compromising the confidentiality, integrity, and availability of the device.

All WatchGuard Fireware OS appliances that run firmware versions prior to Fireware OS 2026.2.3, Fireware OS 12.12.3, or Fireware OS 12.11.10 are affected. The vulnerability is present before the patched releases and any firmware maintenance channel that has not yet been updated must be considered at risk.

The CVSS score of 7.5 indicates a high severity vulnerability. Although the EPSS score is not available, the lack of public exploitation listings and absence from the CISA KEV catalog suggest that exploitation is not yet widespread, but the need for file‑write access limits the attack to environments where an attacker has already compromised or gained elevated local privileges. The impact is essentially equivalent to running arbitrary code in the context of samld, meaning a successful exploitation would give the attacker full control over the SAML service and a strong foothold for further lateral movement or persistence.