WatchGuard firewalls have a large observable footprint. On 14 November 2026 at 01:45 Asia/Shanghai, count-only ZoomEye probes returned 1,270,732 matches for app="WatchGuard Fireware", 836,896 for title="Fireware" and 597,994 for http.body="WatchGuard". The queries used sub_type=all, page 1 and pagesize 1.
The three counts use different fields and must not be added together. The app query is the broad product fingerprint. The title query depends on the page title chosen by the portal or administrative service. The body query can include documentation, vendor pages and firewall login portals.
The number that matters for CVE-2026-86101 is much more specific: how many devices allow a SAML user with Access Portal access to cross into Mobile VPN with SSL without the required authorization. ZoomEye cannot answer that from a product count.
Visibility stops at the configuration
The vulnerability requires a SAML login process and a distinction between portal and VPN entitlement. A public firewall may expose a login page, but the SAML configuration and group mappings sit behind that page. The device may not use SAML at all. It may use SAML only for the portal, only for VPN, or both.
The product count is still useful for owner discovery. Firewalls are often managed by network or security teams, and a public appliance may be in a branch, data center or cloud network. Use the app matches to compare against firewall inventory and certificate records.
Do not infer exploitation from the visible count. WatchGuard said it was not aware of exploitation in the wild when the advisory was published. The priority comes from the exposed remote-access function and the patch boundary, not from an unverified attack claim.
Review the identity-to-service map
For owned devices, list the SAML identity provider, the portal configuration, Mobile VPN groups and the local authorization policy. Test a portal-only identity against each VPN endpoint. Check group changes and session revocation.
Capture identity-provider subject, local user, requested service and authorization result in logs. Search for portal sessions that reach SSL VPN without a corresponding VPN entitlement. Correlate the event with source address and device posture.
Upgrade to the fixed Fireware OS release for the deployed branch. Then verify the running version and review any temporary firewall exception. Restrict Mobile VPN while remediation is pending.
What the observation supports
The search supports a large WatchGuard product presence and a substantial public title and body footprint. It does not support a count of vulnerable SAML configurations. The correct follow-up is an ownership and configuration review.
This is where asset search becomes useful. The product count finds the population. The identity-provider mapping and firewall logs answer whether the entitlement boundary was crossed. The search engine supplies the starting scope, not the final risk determination.