Story · 1 source · 2 articlesfirst Sep 30, 05:00 UTCupdated Sep 30, 05:00 UTC (9d ago)

WatchGuard patches Fireware OS flaws and endpoint driver bug

highVulnerabilityimportance 68CVE-2026-86131 CVE-2026-101891 CVE-2026-86102 CVE-2026-86101 CVE-2026-81433 CVE-2026-13043 CVE-2026-50375 CVE-2026-18145

What's new: Coverage after the earlier ZDI-only summary adds WatchGuard's fix for 15 Fireware OS bugs, notably critical CVE-2026-86131, plus access-point, denial-of-service, and endpoint-driver flaws. Sources disagree on CVE-2026-13043's score, confirmed versions, and whether impact is arbitrary kernel memory access or demonstrated information disclosure.

Merged summary · grok-4.7 · rewritten as coverage arrives

WatchGuard patched 15 Fireware OS flaws, including critical root code injection CVE-2026-86131, and sources differ on endpoint driver flaw CVE-2026-13043.

WatchGuard patched 15 Fireware OS vulnerabilities, led by critical code-injection flaw CVE-2026-86131 (CVSS 9.2) in BOVPN-over-TLS client handling. A remote attacker who controls the VPN server can execute commands as root on a connecting Firebox with no user interaction or prior privileges; fixes are in Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21, and WatchGuard says it is not aware of exploitation. Those releases also fix 13 high-severity issues, including SAML authorization bypass CVE-2026-86101 (CVSS 7.2) and DHCP fingerprinting buffer overflow CVE-2026-81433 (CVSS 8.7); separately, access-point flaws CVE-2026-101891 and CVE-2026-86102, fixed in AP 3.4.8, allow an unauthenticated API session and arbitrary shell commands. The Canadian Centre for Cyber Security (AV26-981) warned that CVE-2026-86134, a pre-authentication NULL pointer dereference, can cause remote denial of service in Fireware OS before those four releases, while ZDI disclosed authenticated Fireware remote code execution bugs CVE-2026-18145 (CVSS 7.2, spamd statushdlr stack overflow) and CVE-2026-13046 (CVSS 7.5, samld deserialization requiring session-directory write access), with no exploitation reported. Sources disagree on endpoint flaw CVE-2026-13043: advisory AV26-990 says Endpoint Security before 8.00.26.0012 lacks authentication in a kernel memory-access driver and allows arbitrary kernel memory access, with no exploitation reported, whereas GBHackers rates it CVSS 9.3 in pskmad.sys, says a local authenticated attacker can read kernel and process memory (a proof of concept dumped LSASS on hardened Windows 11 25H2) and that this is information disclosure rather than verified code execution, and says affected and fixed versions were unconfirmed even though Panda said the issue was resolved in October 2026. In a separate ZDI advisory, CVE-2026-50375 (CVSS 8.8) is a time-of-check time-of-use bug in Microsoft Windows dxgkrnl that lets a local attacker who can already run low-privileged code escalate privileges; exploitation in the wild was not reported.

WatchGuard patched 15 Fireware OS vulnerabilities, led by critical BOVPN-over-TLS code injection CVE-2026-86131 (CVSS 9.2); a remote attacker controlling the VPN server can run root commands on a connecting Firebox with no interaction or…
Fixes are in Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21; WatchGuard says it is not aware of in-the-wild exploitation.
The same releases also fix 13 high-severity issues, including SAML authorization bypass CVE-2026-86101 (CVSS 7.2) and DHCP fingerprinting buffer overflow CVE-2026-81433 (CVSS 8.7).

VendorsWatchGuard Panda Security Microsoft

ProductsFireware OS Firebox WatchGuard Access Point WatchGuard Endpoint Security pskmad.sys PSMEMDriver Windows 11 Windows dxgkrnl

OrganizationsWatchGuard Panda Security Canadian Centre for Cyber Security Zero Day Initiative

Coverage timelineoldest first · each row is one article

Sep 30, 05:00 UTC · 9d ago
ZDI Published Advisories· 52
ZDI-26-749: WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
WatchGuard Fireware OS samld deserialization flaw CVE-2026-13046 can yield remote code execution after a write precondition.
Sep 30, 05:00 UTC · 9d ago
ZDI Published Advisories· 54
ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability
Authenticated stack buffer overflow in WatchGuard Fireware OS spamd allows remote code execution (CVE-2026-18145).

Vulnerabilities in this storyAll →

CVE-2026-1018919.3—
Unauthenticated API session flaw in WatchGuard access points
published 10d ago· WatchGuard Access Points
CVE-2026-130439.3<1%
Missing authentication in WatchGuard PSKMAD kernel driver
published 7d ago· WatchGuard Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-101891	Unauthenticated API session flaw in WatchGuard access points WatchGuard access points have an improper access control flaw in an internal API service. An unauthenticated attacker who can reach the access point over the network can obtain a valid API session without credentials. CVSS 4.0 rates the impact on the access point itself as high for confidentiality, integrity, and availability, with no indicated impact on subsequent systems. The provided data does not name specific models or firmware versions. There is no known public proof of concept and the CVE is not in CISA KEV. Do: Restrict network access to WatchGuard access-point management and internal API interfaces to trusted administrative networks only until a vendor fix is applied. Check WatchGuard security advisories for the affected models and firmware, and install the published update as soon as it is available. Review AP logs for unexpected unauthenticated API sessions from untrusted hosts.	9.3	—		WatchGuard Access Points	—	10d ago
CVE-2026-13043	Missing authentication in WatchGuard PSKMAD kernel driver CVE-2026-13043 is a missing-authentication flaw (CWE-306), also associated with hard-coded credentials (CWE-798), in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products. A local attacker who is already authenticated on the host can bypass the driver’s access-control handshake and issue arbitrary privileged commands to the driver. The published impact is disclosure of kernel and process memory; the CVSS 4.0 score of 9.3 also rates confidentiality, integrity, and availability as high for the vulnerable system and subsequent systems. Affected version ranges were not included in the provided data, so deployments of WatchGuard endpoint products that load PSKMAD should be checked against the vendor advisory. No public proof of concept is known and the CVE is not in CISA KEV, so exploitation is not known to be occurring in the wild. Do: Check WatchGuard’s advisory for this CVE and install the patched endpoint-agent and PSKMAD driver builds as soon as they are published; no fixed version range was included in the data provided here. Until then, restrict local logon on hosts running these products and review endpoint logs for unexpected use of the kernel memory-access driver. Network-only controls do not address this issue, because the attacker must already be authenticated locally.	9.3	<1%	PoC	WatchGuard Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products	—	7d ago
CVE-2026-86131 +4 related CVEs CVE-2026-86134 CVE-2026-18145 CVE-2026-13046 CVE-2026-86101	Root code injection in WatchGuard Fireware BOVPN Over TLS CVE-2026-86131 is a critical code-injection flaw in WatchGuard Fireware OS in how a Firebox handles BOVPN Over TLS client configuration from a remote VPN server. An attacker who controls that server can supply configuration that the connecting Firebox processes unsafely, which the advisory ties to code injection, improper certificate validation, and use of functionality from an untrusted source. Successful exploitation runs arbitrary commands as root on the Firebox, giving full control of the firewall. Only Fireware OS deployments acting as BOVPN Over TLS clients to an attacker-controlled server are affected; exact version ranges were not provided. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Treat any Firebox that initiates BOVPN Over TLS to a server you do not fully control as exposed, and apply WatchGuard's Fireware OS fix as soon as the vendor publishes a patched release for your build. Until then, disable BOVPN Over TLS client use or restrict it to known, certificate-validated endpoints, and review VPN peer configuration and logs for unexpected remote servers or root-level command activity.	9.2 group max	—		WatchGuard Fireware OS	—	9d ago
CVE-2026-50375	Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally. NVD description · AI analysis pending	7.8	<1%		microsoft windows 10 1809 microsoft windows 10 21h2 microsoft windows 10 22h2 +1 more	—	Jul 14, 2026
CVE-2026-81433	Stack buffer overflow in WatchGuard Fireware OS DHCP fingerd CVE-2026-81433 is a stack-based buffer overflow (CWE-120, CWE-121, CWE-787) in the DHCP fingerprinting daemon fingerd on WatchGuard Fireware OS. An unauthenticated attacker on an adjacent network can trigger it by sending a specially crafted DHCP packet, with no user interaction required. Successful exploitation can run arbitrary code on the firewall or crash fingerd, with high impact to confidentiality, integrity, and availability of the device itself (CVSS 4.0 8.7). Affected Fireware OS version ranges are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Apply WatchGuard's Fireware OS fix for CVE-2026-81433 as soon as the vendor publishes a patched build; the advisory data does not name a fixed version. Until then, keep untrusted hosts off segments where they can send DHCP to the firewall, and watch for fingerd crashes as a possible sign of exploit attempts.	8.7	—		WatchGuard Fireware OS (DHCP fingerprinting daemon fingerd)	largeOn the order of 100,000 deployed Fireware appliances (estimate, not a census)	9d ago
CVE-2026-86102	OS command injection in WatchGuard AP internal API CVE-2026-86102 is a critical OS command injection flaw (CWE-78), also associated with incorrect authorization (CWE-863), in the internal API service on WatchGuard access points. An attacker who can reach the AP over the network can send a request that the service passes into the underlying operating system as a shell command, without needing privileges or user interaction (CVSS 4.0 9.3, AV:N/AC:L/PR:N/UI:N, high impact to confidentiality, integrity, and availability on the device). Successful exploitation gives arbitrary command execution on the AP operating system, which can fully compromise the access point. Affected version ranges were not stated in the supplied data, so every WatchGuard AP still running a vulnerable internal API build should be treated as in scope until the vendor confirms otherwise. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Treat this as critical: restrict network access to WatchGuard AP management and internal API interfaces to trusted management hosts only, and apply the vendor firmware update as soon as WatchGuard publishes a fixed release for your model. Until patched, segment AP management traffic from user and guest networks and review AP logs for unexpected shell or API activity. Do not expose AP management services to the internet.	9.3	—		WatchGuard AP (internal API service)	—	10d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-101891

Unauthenticated API session flaw in WatchGuard access points

WatchGuard access points have an improper access control flaw in an internal API service. An unauthenticated attacker who can reach the access point over the network can obtain a valid API session without credentials. CVSS 4.0 rates the impact on the access point itself as high for confidentiality, integrity, and availability, with no indicated impact on subsequent systems. The provided data does not name specific models or firmware versions. There is no known public proof of concept and the CVE is not in CISA KEV.

Do: Restrict network access to WatchGuard access-point management and internal API interfaces to trusted administrative networks only until a vendor fix is applied. Check WatchGuard security advisories for the affected models and firmware, and install the published update as soon as it is available. Review AP logs for unexpected unauthenticated API sessions from untrusted hosts.

9.3

—

WatchGuard Access Points

—

10d ago

CVE-2026-13043

Missing authentication in WatchGuard PSKMAD kernel driver

CVE-2026-13043 is a missing-authentication flaw (CWE-306), also associated with hard-coded credentials (CWE-798), in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products. A local attacker who is already authenticated on the host can bypass the driver’s access-control handshake and issue arbitrary privileged commands to the driver. The published impact is disclosure of kernel and process memory; the CVSS 4.0 score of 9.3 also rates confidentiality, integrity, and availability as high for the vulnerable system and subsequent systems. Affected version ranges were not included in the provided data, so deployments of WatchGuard endpoint products that load PSKMAD should be checked against the vendor advisory. No public proof of concept is known and the CVE is not in CISA KEV, so exploitation is not known to be occurring in the wild.

Do: Check WatchGuard’s advisory for this CVE and install the patched endpoint-agent and PSKMAD driver builds as soon as they are published; no fixed version range was included in the data provided here. Until then, restrict local logon on hosts running these products and review endpoint logs for unexpected use of the kernel memory-access driver. Network-only controls do not address this issue, because the attacker must already be authenticated locally.

9.3

<1%

PoC

WatchGuard Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products

—

7d ago

CVE-2026-86131

Root code injection in WatchGuard Fireware BOVPN Over TLS

CVE-2026-86131 is a critical code-injection flaw in WatchGuard Fireware OS in how a Firebox handles BOVPN Over TLS client configuration from a remote VPN server. An attacker who controls that server can supply configuration that the connecting Firebox processes unsafely, which the advisory ties to code injection, improper certificate validation, and use of functionality from an untrusted source. Successful exploitation runs arbitrary commands as root on the Firebox, giving full control of the firewall. Only Fireware OS deployments acting as BOVPN Over TLS clients to an attacker-controlled server are affected; exact version ranges were not provided. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat any Firebox that initiates BOVPN Over TLS to a server you do not fully control as exposed, and apply WatchGuard's Fireware OS fix as soon as the vendor publishes a patched release for your build. Until then, disable BOVPN Over TLS client use or restrict it to known, certificate-validated endpoints, and review VPN peer configuration and logs for unexpected remote servers or root-level command activity.

9.2

group max

—

WatchGuard Fireware OS

—

9d ago

CVE-2026-50375

Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally

Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.

NVD description · AI analysis pending

7.8

<1%

microsoft windows 10 1809
microsoft windows 10 21h2
microsoft windows 10 22h2
+1 more

—

Jul 14, 2026

CVE-2026-81433

Stack buffer overflow in WatchGuard Fireware OS DHCP fingerd

CVE-2026-81433 is a stack-based buffer overflow (CWE-120, CWE-121, CWE-787) in the DHCP fingerprinting daemon fingerd on WatchGuard Fireware OS. An unauthenticated attacker on an adjacent network can trigger it by sending a specially crafted DHCP packet, with no user interaction required. Successful exploitation can run arbitrary code on the firewall or crash fingerd, with high impact to confidentiality, integrity, and availability of the device itself (CVSS 4.0 8.7). Affected Fireware OS version ranges are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply WatchGuard's Fireware OS fix for CVE-2026-81433 as soon as the vendor publishes a patched build; the advisory data does not name a fixed version. Until then, keep untrusted hosts off segments where they can send DHCP to the firewall, and watch for fingerd crashes as a possible sign of exploit attempts.

8.7

—

WatchGuard Fireware OS (DHCP fingerprinting daemon fingerd)

largeOn the order of 100,000 deployed Fireware appliances (estimate, not a census)

9d ago

CVE-2026-86102

OS command injection in WatchGuard AP internal API

CVE-2026-86102 is a critical OS command injection flaw (CWE-78), also associated with incorrect authorization (CWE-863), in the internal API service on WatchGuard access points. An attacker who can reach the AP over the network can send a request that the service passes into the underlying operating system as a shell command, without needing privileges or user interaction (CVSS 4.0 9.3, AV:N/AC:L/PR:N/UI:N, high impact to confidentiality, integrity, and availability on the device). Successful exploitation gives arbitrary command execution on the AP operating system, which can fully compromise the access point. Affected version ranges were not stated in the supplied data, so every WatchGuard AP still running a vulnerable internal API build should be treated as in scope until the vendor confirms otherwise. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Treat this as critical: restrict network access to WatchGuard AP management and internal API interfaces to trusted management hosts only, and apply the vendor firmware update as soon as WatchGuard publishes a fixed release for your model. Until patched, segment AP management traffic from user and guest networks and review AP logs for unexpected shell or API activity. Do not expose AP management services to the internet.

9.3

—

WatchGuard AP (internal API service)

—

10d ago