CVE-2026-90464
CVE-2026-90464 · Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
CVSS 7.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
fireware os
- Versions
- ≥ 2025.1, < 2026.4: Affected (custom)
- ≥ 12.0, < 12.12.4: Affected (custom)
Update to 12.12.4; Update to 2026.4
fireware os
- Versions
- ≥ 12.0, < 12.5.22: Affected (custom)
Update to 12.5.22