CVE-2026-90441

{
  "etk_id": "ETK-2026-63",
  "cve_id": "CVE-2026-90441",
  "display_id": "CVE-2026-90441",
  "ghsa_id": "GHSA-r9g3-r4fp-gh46",
  "euvd_id": "EUVD-2026-89494",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization flaw in Fireware OS wgagent session initialization",
  "summary": "Fireware OS wgagent management daemon has an authorization flaw during session setup. An authenticated account with restricted administrative access may be able to disrupt wgagent or access files readable by the daemon through the management API.",
  "mitigation": "Upgrade Fireware OS to 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21, as appropriate for the deployed release train. Restrict management API access to trusted administrators until upgrades are complete.",
  "vendor": "WatchGuard",
  "product": "Fireware OS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2026.3, < 2026.3.2",
        ">= 2025.0, < 2026.2.3",
        ">= 12.0, < 12.12.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.3.2",
        "2026.2.3",
        "12.12.3"
      ],
      "package_name": "Fireware OS",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.0, < 12.5.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "12.5.21"
      ],
      "package_name": "Fireware OS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0023,
  "epss_percentile": 0.1319,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.770038883333335,
  "t0_at": "2026-09-29T23:05:47.593000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-29T23:05:47.593000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T23:05:47.593000+00:00",
      "url": "https://github.com/advisories/GHSA-r9g3-r4fp-gh46"
    }
  }
}