Firebox and Fireware OS
CVE-2026-86105: Fireware OS Improper Authorization in Access Portal Reverse Proxy
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Fireware OS (Default) 2026.3 | 2026.3.2 or later |
| Fireware OS (Default) 2025.0 | 2026.2.3 or later |
| Fireware OS (Default) 12.0 | 12.12.3 or later |
| Fireware OS (T15/T35) 12.0 | 12.5.21 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.
Am I affected?
This vulnerability affects Firebox deployments where the Access Portal is configured with multiple reverse-proxy resources.
Exploitation
WatchGuard is not aware of any exploitation of this vulnerability in the wild.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.