An improper authorization flaw in the SAML login process of WatchGuard Fireware OS allows a remote, authenticated SAML user who only has access to the Access Portal to craft a request that grants unauthorized Mobile VPN with SSL access. This vulnerability enables an attacker to bypass intended access controls and establish a VPN session, potentially exposing internal resources. The weakness is rooted in missing or incorrect authorization checks (CWE-285) and missing authorization enforcement (CWE-863).

WatchGuard Fireware OS is affected. The vulnerability exists in versions preceding the following patched releases: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Users should verify that their devices are running at least one of these versions or later to remediate the flaw.

The CVSS score of 7.2 indicates a high impact, while the EPSS score is not available, suggesting limited public exploitation data. The vulnerability can be leveraged remotely by an authenticated SAML user with limited portal privileges. Based on the description, it is inferred that this is not a privilege escalation within the system, but it grants unauthorized VPN access. The lack of a KEV listing indicates no confirmed widespread exploitation, but the potential for significant internal compromise warrants prompt action.