CVE-2026-87969

CVE-2026-87969 is an OS command injection flaw (CWE-78) in the diagnostic command-line interface of WatchGuard access points. An attacker who is already an authenticated administrator can send crafted input to that CLI and cause the device to run arbitrary operating-system commands. Successful exploitation can give high impact on the affected access point, including confidentiality, integrity, and availability, but the CVSS data does not indicate impact on subsequent systems. The issue is rated 8.6 (high) and is reachable over the network with low complexity and no user interaction, though it requires high privileges. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat this as a privileged management-plane issue: restrict WatchGuard AP diagnostic CLI and management access to trusted administrators only, and do not expose AP management interfaces to untrusted networks. Apply the vendor firmware update when WatchGuard publishes a fixed release for your AP models, and review admin accounts and CLI audit logs for unexpected diagnostic commands.