Is CVE-2026-4266 actively exploited?

No active exploitation of CVE-2026-4266 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4266 be exploited remotely?

No. CVE-2026-4266 requires local access to exploit.

What is the CVSS score of CVE-2026-4266?

CVE-2026-4266 has a CVSS score of 8.4 (HIGH).

HOME VULNERABILITIESCVE-2026-4266

HIGH

CVE-2026-4266

CWE-502Published: March 30, 2026· Updated: Mar 30, 2026

8.4

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:20.6th

Official Description

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.This issue affects Fireware OS: 12.1 through 12.11.8 and 2025.1 through 2026.1.2.

Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T-15 and T-35.

NVD Source

Technical Analysis

CVE-2026-4266 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.High

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X