This vulnerability (CVE-2026-1498) in WatchGuard Fireware OS involves LDAP Injection (CWE-90) through exposed authentication or management web interfaces. It enables remote unauthenticated attackers to extract sensitive information from the LDAP authentication server. Furthermore, if an attacker possesses a valid user's passphrase, they can authenticate as that user by supplying only a partial identifier. The vulnerability affects specific versions of Fireware OS including 12.0, 12.5, 2025.1, and ranges up to 12.11.6, 12.5.15, and 2026.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack type, no privileges required, no user interaction, and high scope and impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive LDAP authentication data and potentially unauthorized authentication as legitimate LDAP users with partial identifiers, compromising system security and user accounts. This could allow attackers to bypass normal authentication controls and access protected resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the exposed authentication and management web interfaces and monitor for suspicious activity related to LDAP authentication attempts.