This vulnerability (CVE-2026-13046) involves improper deserialization of untrusted data in the samld component of WatchGuard Fireware OS. An attacker who already has file write access on the device can craft a malicious session file that, when loaded by samld, leads to arbitrary code execution. The flaw affects several version ranges of Fireware OS, including versions from 12.0 up to but not including 12.12.3, 12.11 up to but not including 12.11.10, 2025.0 up to but not including 2026.2.3, and 2026.3 up to but not including 2026.3.2.

Successful exploitation allows an attacker with existing file write privileges on the appliance to execute arbitrary code with the privileges of the samld service. This could lead to further compromise of the system. The vulnerability does not require user interaction but does require prior elevated privileges (high privileges) and partial attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor WatchGuard advisories for updates. Mitigation involves restricting file write access to trusted users and systems to prevent attackers from placing malicious session files.