This vulnerability (CVE-2026-86101) in WatchGuard Fireware OS involves improper authorization in the SAML login process. An authenticated SAML user limited to Access Portal access can escalate privileges to obtain Mobile VPN with SSL access by sending a specially crafted request. The issue impacts versions >=2025.0 and <2026.2.3, >=2026.3 and <2026.3.2, and Fireware OS versions >=12.0 and <12.5.21 or <12.12.3. The CVSS 4.0 score is 7.2, indicating high severity with network attack vector, low attack complexity, and partial impact on confidentiality and integrity. No known exploits are reported in the wild. The vulnerability requires authenticated access and does not affect cloud services.

An attacker with authenticated SAML access limited to the Access Portal can bypass authorization controls to gain unauthorized Mobile VPN with SSL access. This unauthorized access could allow the attacker to use VPN capabilities beyond their intended permissions, potentially exposing internal network resources. The impact is high due to the privilege escalation and access control bypass, but exploitation requires prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict SAML user permissions and monitor for unusual access patterns related to Mobile VPN with SSL. Follow WatchGuard's official advisories for updates.