Insecure deserialization is present in the Fireware Access Portal component of WatchGuard Firebox Fireware OS. The flaw allows an attacker who has previously obtained write access to the local filesystem to construct a crafted serialized payload that is deserialized by the portal service, leading to arbitrary code execution in the context of the portald user. The vulnerability can be used to gain full control over the affected device, compromising confidentiality, integrity, and availability.

The issue affects Fireware OS releases 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on devices that support the Access Portal feature. Firebox models that do not implement Access Portal, such as the T‑15 and T‑35, are not impacted by this vulnerability.

The CVSS score of 8.4 indicates a high severity level. While a specific EPSS value is not published, the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an initial foothold that provides local write privileges; once that condition is met, an attacker can trigger insecure deserialization to execute code. Consequently, systems that have not applied a patch or mitigated the prerequisite vulnerability face a high risk of compromise.