CVE-2026-86131

CVE-2026-86131 is a critical code-injection flaw in WatchGuard Fireware OS in how a Firebox handles BOVPN Over TLS client configuration from a remote VPN server. An attacker who controls that server can supply configuration that the connecting Firebox processes unsafely, which the advisory ties to code injection, improper certificate validation, and use of functionality from an untrusted source. Successful exploitation runs arbitrary commands as root on the Firebox, giving full control of the firewall. Only Fireware OS deployments acting as BOVPN Over TLS clients to an attacker-controlled server are affected; exact version ranges were not provided. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat any Firebox that initiates BOVPN Over TLS to a server you do not fully control as exposed, and apply WatchGuard's Fireware OS fix as soon as the vendor publishes a patched release for your build. Until then, disable BOVPN Over TLS client use or restrict it to known, certificate-validated endpoints, and review VPN peer configuration and logs for unexpected remote servers or root-level command activity.