The wgagent management daemon contains a missing authorization check in its session initialization function. A low‑privileged, authenticated user—including read‑only or guest administrators—can craft a specially formed management API request that forces the wgagent process to crash and, simultaneously, read any files that the daemon can access. This results in a denial of service and the unintended disclosure of potentially sensitive data. The weakness corresponds to path‑traversal (CWE‑22), null pointer dereference (CWE‑476), and missing access control (CWE‑862).

WatchGuard Fireware OS devices are impacted. Versions before Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 contain the flaw; the listed firmware releases include the fix.

The vulnerability scores a moderate‑high CVSS of 7.1. No EPSS data is available and it is not listed in CISA KEV. Based on the requirement of an authenticated session to the wgagent API, the attack vector is likely local or requires network access to the management interface. An attacker would need valid credentials with at least read or guest privileges to send the crafted request and trigger the crash or read files.