This vulnerability in WatchGuard Fireware OS arises from insufficient authorization checks in the wgagent management daemon's session initialization function. An authenticated user with low privileges can exploit this flaw to cause a denial of service by crashing the wgagent process and to read arbitrary files accessible to the daemon. Exploitation requires authentication but no user interaction. The vulnerability affects versions >=12.0 <12.5.21, >=12.0 <12.12.3, >=2025.0 <2026.2.3, and >=2026.3 <2026.3.2.

An attacker with low-privileged authenticated access can crash the wgagent process, causing a denial of service, and read arbitrary files accessible to the daemon, potentially exposing sensitive information. There is no indication of privilege escalation or remote unauthenticated exploitation. The impact is limited to authenticated users with at least low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the management API to trusted users only and monitor for unusual activity. Avoid using low-privileged accounts for untrusted users.