CVE-2026-86105

Executive Summary

CVE-2026-86105 is an improper authorization vulnerability in the Access Portal reverse proxy component of WatchGuard Fireware OS. An authenticated, low-privileged Access Portal user can access web applications they are not authorized for by sending a specially crafted request targeting a resource they are permitted to access. The vulnerability maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal), which indicates that the reverse proxy fails to properly validate or restrict the requested resource path before serving content, allowing authorization boundaries to be bypassed.

Technical Analysis

The vulnerability resides in the Access Portal reverse proxy of Fireware OS. Access Portal is a feature that provides authenticated access to internal web applications through a reverse proxy. The core flaw is an improper authorization check combined with improper path handling (CWE-22). When an authenticated low-privileged user sends a request for a resource they are authorized to access, the reverse proxy processes the request without adequately verifying that the requested target web application falls within the user's assigned authorization scope.

The CWE-22 classification (path traversal / improper limitation of a pathname to a restricted directory) is the key technical indicator. In a reverse proxy context, this typically manifests when the proxy resolves the requested path without canonicalization or boundary enforcement, allowing the requesting user to reach backend applications outside their permitted set. The NVD description states the attacker sends "a specially crafted request for a different resource which they are authorized to access" — meaning the authorization decision is made against a benign resource while the actual resolved target differs from what was validated.

Because the vulnerability is an authorization/access-control bypass rather than a memory-safety bug, exploitation does not require memory corruption primitives. It requires only a valid low-privileged Access Portal session and the ability to craft an HTTP request. The attack surface is the Access Portal HTTPS listener, which is typically internet-facing or reachable from untrusted network segments in remote-access deployments.

No public proof-of-concept, exploit code, or Nuclei template exists as of this report. The specific request syntax, parameter names, or path normalization behavior that triggers the bypass are not disclosed in the NVD entry. Analysts should treat the attack chain as inferred from the vulnerability class (improper authorization via path handling in a reverse proxy) rather than from confirmed technical detail.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description. No public PoC is available.

1. Reconnaissance / Target Identification: The attacker identifies an exposed WatchGuard Fireware OS Access Portal interface (reverse proxy endpoint). This can be accomplished through internet scanning (e.g., Shodan queries for Access Portal login pages) or during an internal engagement against a remote-access segment. The attacker must possess valid low-privileged Access Portal credentials — the vulnerability requires authentication.

2. Triggering the Flaw: With an authenticated session, the attacker issues a specially crafted HTTP request that targets a resource within their authorized scope. Due to improper authorization handling in the reverse proxy, the request is validated against the authorized resource but resolves to a different backend web application that the user is not authorized to access. The request itself is a legitimate low-privileged request; the bypass derives from how the proxy maps or resolves the requested path relative to authorization checks.

3. Payload / Execution (vulnerability-class level): The request is delivered over the normal Access Portal HTTP/HTTPS channel. No memory corruption or code injection is required — the exploit is an access-control logic bypass. The precise path construction or encoding used to make the proxy resolve to the unauthorized application is not disclosed in the NVD description, so no specific parameter or path sequence is asserted here.

4. Post-Exploitation Impact: Successful exploitation grants the low-privileged user unauthorized access to other web applications proxied by the Access Portal. This expands the user's reachable attack surface and may expose sensitive internal applications, session data, or administrative interfaces behind the reverse proxy. The confidentiality impact is the primary concern (unauthorized information access); there is no described integrity or availability impact.

Impact Assessment

This is an authorization bypass with a confidentiality-focused impact. CVSS 3.1 metrics derived from the described behavior: AV:N (network-reachable reverse proxy), AC:L (no special conditions beyond crafting a request), PR:L (requires authenticated low-privileged Access Portal user), UI:N (no user interaction required), S:C (the vulnerable proxy component impacts resources outside its authorization scope — scope change), C:H (unauthorized access to other web applications), I:N (no stated write/modify capability), A:N (no stated denial of service). No official CVSS score or vector is provided in the source data; the vector shown in METADATA is an analyst-derived estimate based strictly on the described mechanism and must not be treated as vendor-assigned.

Business impact: Organizations that rely on Access Portal for remote access may have authorization boundaries between user groups silently bypassed. A malicious or compromised low-privileged account (e.g., a contractor, vendor, or partner credential) could pivot to internal web applications outside their intended scope. The blast radius is limited to applications reachable through the same Access Portal reverse proxy instance, but within that boundary, the exposure can be significant for organizations that proxy administrative or sensitive internal apps.

Key risk factors:

• Requires valid credentials (lowers exploitability from the internet for unauthenticated actors, but insider or compromised-credential risk remains high).
• No patch exists (patch confidence 0/4), so the window of exposure is indefinite.
• No CISA KEV listing and no known in-the-wild exploitation as of this report.

Detection Guidance

Sigma Rule

title: WatchGuard Fireware Access Portal Improper Authorization / Path Bypass Attempt
id: 7c2f9a14-3b6e-4d1a-9f0e-8a1c2f4b6d90
status: experimental
description: Detects crafted requests against Fireware Access Portal reverse proxy that may bypass authorization to reach unauthorized web applications (CVE-2026-86105, CWE-22).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86105
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_access_portal:
    cs-uri-stem|contains:
      - 'AccessPortal'
      - 'access_portal'
      - '/portal/'
  selection_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '..%5c'
      - '%2e%2e/'
      - '..;/'
      - '..\'
  selection_abnormal_encoding:
    cs-uri-stem|re: '(?i)(%2e%2e|\.\./|\.\.\\)'
  condition: selection_access_portal and (selection_traversal or selection_abnormal_encoding)
falsepositives:
  - Legitimate applications using encoded path segments
  - Security scanners during authorized testing
level: medium

YARA Rule

rule CVE_2026_86105_AccessPortal_PathAuthBypass
{
    meta:
        description = "Detects path-traversal / improper-authorization request patterns targeting WatchGuard Fireware Access Portal (CVE-2026-86105)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86105"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ap1 = "AccessPortal" ascii nocase
        $ap2 = "access_portal" ascii nocase
        $trav1 = "..%2f" ascii nocase
        $trav2 = "..%5c" ascii nocase
        $trav3 = "%2e%2e/" ascii nocase
        $trav4 = "../" ascii
        $trav5 = "..;/" ascii

    condition:
        (any of ($ap*)) and (any of ($trav*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86105 WatchGuard Fireware Access Portal Improper Authorization / Path Traversal Attempt"; flow:established,to_server; http.uri; content:"AccessPortal"; nocase; http.uri; content:"..%2f"; nocase; sid:90086105; rev:1; classtype:attempted-user; reference:cve,CVE-2026-86105; metadata:affected_product WatchGuard_Fireware, attack_target Web_Server, created_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-86105 WatchGuard Fireware Access Portal Path Traversal (encoded)"; flow:established,to_server; http.uri; content:"%2e%2e%2f"; nocase; sid:90086106; rev:1; classtype:attempted-user; reference:cve,CVE-2026-86105; metadata:affected_product WatchGuard_Fireware, created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method == "GET" and
     stringContains(url.path, "portal") ]
  [http where stringContains(url.path, "..%2f") or
     stringContains(url.path, "%2e%2e%2f") or
     stringContains(url.path, "..;/") or
     stringContains(url.query, "..%2f")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=watchguard_access_portal
| eval uri_lower=lower(uri)
| where (match(uri_lower, "accessportal|access_portal|/portal/"))
    AND (match(uri_lower, "\.\.%2f|\.\.%5c|%2e%2e%2f|\.\./|\.\.;/|\.\.\\"))
| stats count min(_time) as first_seen max(_time) as last_seen
    values(uri) as sample_uris by src_ip, user
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,watchguard,access_portal,">
  <rule id="100861" level="10">
    <if_sid>31100</if_sid>
    <url>AccessPortal|access_portal|/portal/</url>
    <regex type="pcre2">(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f|\.\./|\.\.;\/|\.\.\\)</regex>
    <description>CVE-2026-86105: WatchGuard Fireware Access Portal improper authorization / path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_attempt,access_control_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available from any tracked source as of this report.

1. Immediate Mitigations (compensating controls):

   • Restrict Access Portal exposure: place the interface behind network access controls (VPN, allowlisted source IPs, geo-blocking) where operationally feasible.
   • Enforce least privilege on Access Portal accounts: minimize the number of low-privileged accounts and audit which user groups can reach which backend applications.
   • Deploy detection controls (Sigma/Suricata/Splunk/EQL/Wazuh rules above) to monitor for encoded path-traversal syntax and anomalous resource access through the proxy.
   • Consider temporarily disabling or narrowing Access Portal proxying for sensitive internal applications until a fix is available.
   • Add a reverse proxy/WAF layer in front of Access Portal with path canonicalization and traversal normalization rules.

2. Patch / Upgrade Steps:

   • No patch is currently available. Monitor the vendor (WatchGuard) security advisory channel and the NVD entry for CVE-2026-86105 for patch publication.
   • Once a fixed Fireware OS version is released, upgrade promptly and validate that the authorization boundary between Access Portal users and backend applications is enforced.

3. Long-Term Hardening:

   • Enforce canonical path resolution and strict authorization checks at the reverse proxy boundary as a design principle.
   • Segment backend web applications so that Access Portal proxying cannot laterally reach administrative or sensitive applications outside user scope.
   • Implement continuous monitoring for authorization-bypass patterns, including malformed/encoded path segments.
   • Require MFA and strong session controls on Access Portal accounts to reduce the value of stolen low-privileged credentials.

References

• NVD — CVE-2026-86105: https://nvd.nist.gov/vuln/detail/CVE-2026-86105
• WatchGuard Security Advisories (monitor for Fireware OS update): https://www.watchguard.com/wgrd-psirt/advisories
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-86105 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-86105 as of this report. No public PoC, exploit code, or Nuclei template is available.