Is CVE-2026-82332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82332 being exploited in the wild.

How severe is CVE-2026-82332?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Watchguard Fireware OS 2025.1 to 2026.3, 12.7 to 12.12.3.

Is there a fix for CVE-2026-82332?

Yes: fixed in Fireware OS 2026.4, Fireware OS 12.12.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82332 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-82332?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82332: WatchGuard Fireware OS improper authentication in AuthPoint MFA

CVE-2026-82332 · Severity: info · Published 2026-10-27

WatchGuard Fireware OS is a firewall appliance that protects enterprise networks and supports multi-factor authentication through AuthPoint integration. A vulnerability in the MFA process allows an unauthenticated attacker with local access to the appliance to hijack another user's authentication session and gain unauthorized access by manipulating MFA notifications. An attacker could exploit this to bypass multi-factor authentication protections and take over user accounts.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-82332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82332 being exploited in the wild.
How severe is CVE-2026-82332?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Watchguard Fireware OS 2025.1 to 2026.3, 12.7 to 12.12.3.
Is there a fix for CVE-2026-82332?: Yes: fixed in Fireware OS 2026.4, Fireware OS 12.12.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82332 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-82332?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fireware OS 2026.4, Fireware OS 12.12.4

Technical details

An improper authentication vulnerability (CWE-287, CWE-346) in WatchGuard Fireware OS's AuthPoint MFA verification process allows a local, unauthenticated attacker to hijack in-progress MFA sessions via a specially crafted request combined with social engineering (convincing the victim to accept a push notification). The attacker must have local access to the appliance and the Fireware deployment must have AuthPoint integration configured. Successful exploitation results in session hijacking and authentication bypass.

Affected products

WatchGuard Fireware OS 2025.1 to 2026.3, 12.7 to 12.12.3

Timeline

2026-10-27: disclosed

References

https://psirt.watchguard.com/CVE-2026-82332

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.