API service of the WatchGuard AP allows attackers

psirt.watchguard.com • September 29, 2026

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Weakness Type and Impact #

CWE CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE CWE-863 Incorrect Authorization

CAPEC CAPEC-88 OS Command Injection

Exploitation Status #

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection and Authentication Flaws in WatchGuard Access Points Three critical vulnerabilities have been identified in WatchGuard's access points, allowing attackers to execute arbitrary commands and bypass authentication. The flaws include CVE-2026-101891, which permits unauthenticated access to a valid API session, and CVE-2026-86102, enabling command injection through the internal API service. The third vulnerability, CVE-2026-87969, allows authenticated administrators to execute arbitrary commands via crafted input. All three vulnerabilities are classified as critical or high risk, with CVSS scores of 9.3 and 8.6 respectively. WatchGuard has released firmware updates to address these issues, and users are urged to apply them immediately. As of the latest reports, there is no evidence that these vulnerabilities have been exploited in the wild. The affected firmware versions are those prior to 3.4.8. WatchGuard has not disclosed specific detection methods for potential attacks. 7 sources 72

Extracted Entities

API service of the WatchGuard AP allows attackers

The full story

Extracted Entities

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Vulnerabilities (1)