CVE-2026-13046

Executive Summary

CVE-2026-13046 is a deserialization of untrusted data vulnerability (CWE-502) in WatchGuard Fireware OS's SAML single sign-on session handling component, identified as samld. An attacker who has already obtained the ability to write files on the appliance can cause samld to load a maliciously crafted session file, resulting in arbitrary code execution in the context of the samld service. The vulnerability is not exploitable in isolation — it requires a pre-existing file-write primitive on the target appliance as a precondition. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE has not been scored by FIRST.org (EPSS pending) and is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in the SAML single sign-on session handling logic of WatchGuard Fireware OS, specifically in the samld service. samld is the daemon responsible for processing SAML SSO authentication sessions on the appliance.

The core defect is a deserialization of untrusted data flaw, classified under CWE-502. When samld loads a session file, it deserializes its contents without adequately validating the integrity or origin of that data. If an attacker can place a maliciously crafted session file at a location that samld will read, the deserialization routine will process attacker-controlled serialized data. Because deserialization of untrusted input frequently instantiates attacker-influenced objects or executes logic during object reconstruction, this results in code execution within the security context of the samld process.

Key technical characteristics, derived strictly from the available description:

• Attack surface: The SAML SSO session file loading path within samld. The exact file path, serialization format, and object model are not disclosed in the provided data and are not reproduced here.
• Precondition: The attacker must already possess the ability to write files on the appliance. This means CVE-2026-13046 is a post-compromise privilege escalation / code execution primitive, not a standalone remote entry point.
• Execution context: Code executes as the samld service. The privilege level of samld on Fireware OS is not specified in the provided description, so the precise privilege boundary escalation cannot be stated with certainty.
• Vulnerability class implications: In deserialization flaws, the payload typically encodes a serialized object graph. When the vulnerable parser reconstructs that graph, it may invoke class constructors, magic methods, or gadget chains present in the runtime that lead to arbitrary command or code execution. The specific gadget chain, language runtime, and serialization library used by samld are not disclosed in the source data and are deliberately not speculated upon here.

No CVSS vector, EPSS score, or affected version range is available. The absence of a version range (Affected Versions: []) means defenders cannot rely on version-matching alone and should treat any Fireware OS deployment with SAML SSO enabled as potentially in scope pending vendor confirmation.

Exploitation Scenarios

No public PoC is available. The attack chain below is described strictly at the vulnerability-class level and reflects the explicit precondition stated in the NVD description (existing file-write capability).

1) Reconnaissance / target identification The attacker identifies a WatchGuard Fireware OS appliance with SAML SSO configured. Fingerprinting can be performed via exposed management or authentication interfaces (e.g., HTTPS service banners, certificate subject, or Fireware-specific pages). Because the flaw is not remotely reachable on its own, this step is about locating a target where the attacker already has, or can obtain, a file-write foothold.

2) Establishing the file-write precondition The attacker must first obtain the ability to write files on the appliance. The NVD description does not state how this is achieved. Plausible routes consistent with the stated precondition include chaining a separate vulnerability, abusing an exposed management or upload feature, or leveraging another already-compromised service. Because this prerequisite is external to CVE-2026-13046, the specific method is unknown and is not fabricated here.

3) Triggering the deserialization flaw Once write access exists, the attacker places a maliciously crafted session file at a location that samld will load during SAML SSO session handling. The file contains attacker-controlled serialized data. When samld reads and deserializes the file, the untrusted data is processed without sufficient validation, and attacker-influenced object reconstruction occurs.

4) Payload / execution At the vulnerability-class level, a deserialization payload abuses object instantiation and reconstruction behavior to achieve code execution. The exact payload structure, gadget chain, and target runtime are not available in the provided data and are not invented in this report.

5) Post-exploitation impact Successful exploitation yields arbitrary code execution in the context of the samld service on the appliance. Potential downstream effects depend on the privileges of samld: session forgery, authentication bypass for SSO-protected resources, lateral movement into the Fireware management plane, persistence, and potential further compromise of the appliance and the network segments it protects.

Impact Assessment

• Confidentiality (C:H): Code execution as samld could expose session data, SAML assertions, and potentially appliance configuration or secrets handled by the service.
• Integrity (I:H): An attacker could manipulate SAML sessions or forge authentication state managed by samld, and modify files within the reachable context.
• Availability (A:H): A crash or malicious manipulation of the SSO daemon could disrupt authentication services for all users relying on SAML SSO.
• Scope: Fireware OS is a network security platform (firewall/UTM). Compromise of an authentication daemon on the edge appliance can have a blast radius extending to all protected network segments and to any identity provider integration trusting the appliance.
• Business impact: SAML SSO is typically used in enterprise environments for centralized authentication. Code execution in the SSO service can undermine the trust model of the identity federation, potentially enabling broader access to downstream applications.
• Exploitability caveat: The requirement of a pre-existing file-write foothold substantially reduces the standalone severity of this CVE but elevates its value as a post-exploitation chaining component. Defenders should treat any confirmed file-write compromise of a Fireware appliance as an urgent escalation path to full SSO-daemon code execution.
• Confidence: LOW-to-MODERATE. Impact statements are inferred from the vulnerability class and the stated execution context; no CVSS subscores were assigned by the vendor or NVD, and the vector above is an analyst estimate, not an authoritative score.

Detection Guidance

Sigma Rule

title: WatchGuard Fireware samld Malicious Session File Deserialization (CVE-2026-13046)
id: 8f3b2a1c-1304-6d46-9e0f-samld001
status: experimental
description: Detects suspicious file writes or modifications to SAML session file locations that may precede loading by the samld service in WatchGuard Fireware OS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13046
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1059
  - attack.t1190
  - cve.2026.13046
logsource:
  product: watchguard
  service: fireware
detection:
  selection_daemon:
    process:
      - 'samld'
      - '/usr/bin/samld'
  selection_fileevent:
    EventType:
      - 'file_created'
      - 'file_modified'
      - 'file_write'
  selection_session:
    TargetFilename|contains:
      - 'saml'
      - 'session'
  condition: selection_daemon and selection_fileevent and selection_session
falsepositives:
  - Legitimate SAML session lifecycle events
  - Administrative session resets
level: medium

YARA Rule

rule CVE_2026_13046_WatchGuard_Saml_Session_Deserialization
{
    meta:
        description = "Detects potentially malicious serialized session files targeting WatchGuard Fireware samld (CVE-2026-13046)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13046"
        date = "2026-01-01"
        severity = "high"

    strings:
        $magic_java = "\xAC\xED\x00\x05"          // Java serialization magic
        $magic_native = "\x04\x22\x4D\x18"        // .NET BinaryFormatter magic
        $magic_php_o  = "O:"                       // PHP serialized object
        $magic_php_a  = "a:"                       // PHP serialized array
        $saml         = "SAML" nocase
        $session      = "session" nocase
        $assertion    = "Assertion" nocase

    condition:
        filesize < 5MB and
        (
            any of ($magic_*) and any of ($saml, $session, $assertion)
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-13046 WatchGuard Fireware samld Suspicious Session File Write (possible deserialization)"; flow:established,to_server; content:"saml"; nocase; content:"session"; nocase; distance:0; within:200; classtype:attempted-admin; reference:cve,2026-13046; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13046; sid:202613046; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-13046 WatchGuard Fireware SAML Session Manipulation Attempt"; flow:established,to_server; http.uri; content:"saml"; nocase; http.uri; content:"session"; nocase; classtype:web-application-attack; reference:cve,2026-13046; sid:202613047; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ file where file.name : ("*saml*" or "*session*") and
      event.action : ("created" or "modified" or "write") ]
  [ process where process.name : "samld" and
      event.action : ("start" or "loaded") ]

Splunk SPL Query

index=firewall OR index=edr OR index=syslog (sourcetype=watchguard* OR host=*fireware*)
(process_name="samld" OR process="samld" OR "samld")
| stats count by host, process_name, file_path, action, user
| where count > 0
| sort - count

index=* ("samld" AND ("saml" OR "session"))
| eval risk=case(
    match(_raw, "(?i)serializ|deserial|object"), "high",
    match(_raw, "(?i)write|create|modif"), "medium",
    true(), "low")
| table _time, host, source, risk, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="watchguard,fireware,cve-2026-13046,">
  <rule id="130460" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">samld</field>
    <field name="action">\.+</field>
    <description>CVE-2026-13046: Possible samld session file manipulation on WatchGuard Fireware.</description>
    <mitre>
      <id>T1059</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_13046,</group>
  </rule>

  <rule id="130461" level="12">
    <if_sid>130460</if_sid>
    <field name="file_path">\.+saml.*|\.+session.*</field>
    <description>CVE-2026-13046: Suspicious write to SAML session path observed near samld activity.</description>
    <group>cve_2026_13046,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Treat any confirmed file-write compromise of a Fireware OS appliance as an urgent escalation path. Isolate affected appliances and initiate incident response.
• Restrict access to the Fireware management interface to trusted administrative networks only; do not expose management services to the internet.
• Where feasible, temporarily reduce reliance on SAML SSO or restrict its scope to limit the value of the samld execution context, understanding this does not fix the underlying flaw.
• Harden file-write permissions on the appliance so that only authorized processes and administrators can write to directories used for session files.
• Audit for any conditions that grant external parties the ability to write files to the appliance (upload features, management APIs, exposed services).
• Enable detailed logging of file writes and samld behavior if the platform supports it, routing logs to an external SIEM.

2) Patch / upgrade steps

• No vendor patch or advisory is available in the tracked data. Monitor WatchGuard's official security advisory channel (WatchGuard Security Center / PSIRT) for a Fireware OS release that addresses CVE-2026-13046.
• When a fix is published, validate the target release in a staging environment before production rollout.
• Because no affected version range is confirmed, verify with WatchGuard support which Fireware OS releases are impacted before assuming any version is safe.

3) Long-term hardening

• Apply a defense-in-depth model: eliminate all unauthenticated or weakly authenticated file-write paths on edge appliances to remove the precondition for this class of chaining vulnerability.
• Enforce least privilege for service accounts and daemons such as samld.
• Implement network segmentation and zero-trust access around management planes of security appliances.
• Maintain continuous monitoring and threat hunting for post-exploitation activity on edge devices, given their high value as a pivot point.
• Track CWE-502 (deserialization of untrusted data) across the asset inventory and prioritize any product that deserializes attacker-reachable data.

References

• NVD — CVE-2026-13046: https://nvd.nist.gov/vuln/detail/CVE-2026-13046
• MITRE CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WatchGuard Security Center (vendor advisories; monitor for CVE-2026-13046 guidance): https://www.watchguard.com/wgrd-security-hub

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-13046. CISA KEV status: NOT listed. No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided data.