CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy

What is CVE-2026-86105?

CVE-2026-86105 is a medium-severity missing authorization vulnerability in Watchguard Fireware, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

Weakness: CWE-285, CWE-22, CWE-176

Which versions are affected by CVE-2026-86105?

It affects 1 product.

Products include Watchguard Fireware.

How do I fix CVE-2026-86105?

No fix has been published for CVE-2026-86105 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-86105 being exploited?

There is no known exploitation of CVE-2026-86105 in the wild and no public exploit code.

Other vulnerabilities in Watchguard Fireware

• CVE-2022-26318 WatchGuard Firebox and XTM Appliances Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-14733 WatchGuard Firebox Out of Bounds Write Exploited Critical 9.3
• CVE-2025-9242 WatchGuard Firebox Out-of-Bounds Write Exploited Critical 9.3
• CVE-2022-23176 WatchGuard Firebox and XTM Privilege Escalation Exploited High 8.8
• CVE-2022-31789 Integer overflow in n/a Critical 9.8

All Watchguard Fireware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6588-r8h7-2mc8.