CVE 2026 101891

psirt.watchguard.com • September 29, 2026

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

Weakness Type and Impact #

CWE CWE-284 Improper Access Control

CWE CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

CAPEC CAPEC-115 Authentication Bypass

Exploitation Status #

Discovered internally by WatchGuard finder

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection and Authentication Flaws in WatchGuard Access Points Three critical vulnerabilities have been identified in WatchGuard's access points, allowing attackers to execute arbitrary commands and bypass authentication. The flaws include CVE-2026-101891, which permits unauthenticated access to a valid API session, and CVE-2026-86102, enabling command injection through the internal API service. The third vulnerability, CVE-2026-87969, allows authenticated administrators to execute arbitrary commands via crafted input. All three vulnerabilities are classified as critical or high risk, with CVSS scores of 9.3 and 8.6 respectively. WatchGuard has released firmware updates to address these issues, and users are urged to apply them immediately. As of the latest reports, there is no evidence that these vulnerabilities have been exploited in the wild. The affected firmware versions are those prior to 3.4.8. WatchGuard has not disclosed specific detection methods for potential attacks. 4 sources 72

Extracted Entities

CVE 2026 101891

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Platforms (1)