CVE-2026-13046: WatchGuard Fireware OS SAML RCE Vulnerability

CVE-2026-13046 Overview

CVE-2026-13046 is a deserialization of untrusted data vulnerability [CWE-502] in WatchGuard Fireware OS. The flaw affects the SAML single sign-on session handling component known as samld. An attacker with the ability to write files on the appliance can craft a malicious session file. When samld loads that file, the process deserializes attacker-controlled data and executes arbitrary code in the context of the samld service.

Critical Impact
Attackers who already possess file-write access on a WatchGuard Fireware appliance can achieve arbitrary code execution within the SAML SSO service, compromising authentication flows and appliance integrity.

Affected Products

WatchGuard Fireware OS (SAML SSO component samld)
WatchGuard Firebox appliances running affected Fireware OS versions
Refer to the WatchGuard CVE-2026-13046 Advisory for specific affected versions

Discovery Timeline

2026-09-30 - CVE-2026-13046 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-13046

Vulnerability Analysis

The vulnerability resides in the samld service, which handles SAML single sign-on session state on Fireware OS. The service reads persisted session data from disk and reconstructs in-memory objects through a deserialization routine. The routine does not validate the structure or trustworthiness of the serialized payload before instantiating objects.

An attacker who can write to the file system location consumed by samld places a crafted session file at that path. On the next load, samld deserializes the malicious payload and triggers attacker-controlled logic during object reconstruction. Execution occurs in the security context of the samld process, which handles authentication flows for SSO users.

This is a post-authentication or post-compromise primitive rather than an unauthenticated network attack. It converts an existing file-write capability into full code execution inside a privileged appliance service. That conversion is significant because SSO session handling touches identity assertions, session tokens, and credential flows.

Root Cause

The root cause is unsafe deserialization of untrusted data [CWE-502]. Fireware OS treats session files on disk as trusted input and reconstructs objects without integrity verification, type restrictions, or a safe allow-list of deserializable classes.

Attack Vector

Exploitation requires prior file-write access to the appliance. Chained with any file-write primitive, such as a path traversal or an authenticated administrative bug, the attacker writes a serialized payload to the location read by samld. Loading the payload yields code execution in the samld service context, enabling manipulation of SAML sessions and further lateral movement on the appliance. See the WatchGuard CVE-2026-13046 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-13046

Indicators of Compromise

Unexpected or unfamiliar files appearing in directories used by the samld service for session persistence
Anomalous restarts, crashes, or child processes spawned by the samld service
SAML session artifacts referencing users, issuers, or timestamps that do not match legitimate SSO activity
Outbound connections initiated by the samld process to unexpected destinations

Detection Strategies

Monitor file integrity on Fireware OS directories used for SAML session storage and flag writes from non-standard processes
Alert on process lineage anomalies where samld spawns shells, network utilities, or interpreters
Review authentication logs for SAML assertions that do not correlate to legitimate identity provider events
Correlate appliance management-plane access with subsequent file-system modifications on the Firebox

Monitoring Recommendations

Forward Fireware OS system and authentication logs to a centralized SIEM for retention and correlation
Track administrative sessions and configuration changes on all WatchGuard appliances
Baseline normal samld service behavior and alert on deviations in CPU, memory, or network activity

How to Mitigate CVE-2026-13046

Immediate Actions Required

Apply the WatchGuard security update referenced in the WatchGuard CVE-2026-13046 Advisory as soon as it is available for your platform
Restrict administrative access to Fireware OS appliances to trusted management networks and jump hosts only
Rotate SAML signing keys, SSO service credentials, and administrator passwords if compromise is suspected
Audit the appliance file system for unauthorized files in samld session directories

Patch Information

WatchGuard has published guidance and fixed versions in the vendor PSIRT advisory. Consult the WatchGuard CVE-2026-13046 Advisory for the specific Fireware OS versions that remediate the deserialization flaw and follow the vendor upgrade procedure.

Workarounds

Disable SAML single sign-on on affected appliances until patching is complete, if operationally feasible
Enforce strict access control lists on the appliance management interface to reduce the population of accounts that could obtain file-write access
Monitor and alert on any modification to files consumed by the samld service

bash

# Example: restrict Firebox management access to a specific admin subnet
# (adapt to your environment; consult WatchGuard documentation for exact syntax)
policy-manager set mgmt-access allow-from 10.10.20.0/24
policy-manager set mgmt-access deny-from any