WatchGuard Patches Critical Fireware OS Code Injection Vulnerability

WatchGuard access points have an improper access control flaw in an internal API service. An unauthenticated attacker who can reach the access point over the network can obtain a valid API session without credentials. CVSS 4.0 rates the impact on the access point itself as high for confidentiality, integrity, and availability, with no indicated impact on subsequent systems. The provided data does not name specific models or firmware versions. There is no known public proof of concept and the CVE is not in CISA KEV.

Do: Restrict network access to WatchGuard access-point management and internal API interfaces to trusted administrative networks only until a vendor fix is applied. Check WatchGuard security advisories for the affected models and firmware, and install the published update as soon as it is available. Review AP logs for unexpected unauthenticated API sessions from untrusted hosts.

CVE-2026-86102 is a critical OS command injection flaw (CWE-78), also associated with incorrect authorization (CWE-863), in the internal API service on WatchGuard access points. An attacker who can reach the AP over the network can send a request that the service passes into the underlying operating system as a shell command, without needing privileges or user interaction (CVSS 4.0 9.3, AV:N/AC:L/PR:N/UI:N, high impact to confidentiality, integrity, and availability on the device). Successful exploitation gives arbitrary command execution on the AP operating system, which can fully compromise the access point. Affected version ranges were not stated in the supplied data, so every WatchGuard AP still running a vulnerable internal API build should be treated as in scope until the vendor confirms otherwise. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Treat this as critical: restrict network access to WatchGuard AP management and internal API interfaces to trusted management hosts only, and apply the vendor firmware update as soon as WatchGuard publishes a fixed release for your model. Until patched, segment AP management traffic from user and guest networks and review AP logs for unexpected shell or API activity. Do not expose AP management services to the internet.

CVE-2026-86131 is a critical code-injection flaw in WatchGuard Fireware OS in how a Firebox handles BOVPN Over TLS client configuration from a remote VPN server. An attacker who controls that server can supply configuration that the connecting Firebox processes unsafely, which the advisory ties to code injection, improper certificate validation, and use of functionality from an untrusted source. Successful exploitation runs arbitrary commands as root on the Firebox, giving full control of the firewall. Only Fireware OS deployments acting as BOVPN Over TLS clients to an attacker-controlled server are affected; exact version ranges were not provided. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat any Firebox that initiates BOVPN Over TLS to a server you do not fully control as exposed, and apply WatchGuard's Fireware OS fix as soon as the vendor publishes a patched release for your build. Until then, disable BOVPN Over TLS client use or restrict it to known, certificate-validated endpoints, and review VPN peer configuration and logs for unexpected remote servers or root-level command activity.