CVE 2026 86131

psirt.watchguard.com • September 30, 2026

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Weakness Type and Impact #

CWE CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE CWE-295 Improper Certificate Validation

CWE CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CAPEC CAPEC-94 Adversary in the Middle (AiTM)

CAPEC CAPEC-242 Code Injection

Exploitation Status #

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection and Authentication Flaws in WatchGuard Access Points Three critical vulnerabilities have been identified in WatchGuard's access points, allowing attackers to execute arbitrary commands and bypass authentication. The flaws include CVE-2026-101891, which permits unauthenticated access to a valid API session, and CVE-2026-86102, enabling command injection through the internal API service. The third vulnerability, CVE-2026-87969, allows authenticated administrators to execute arbitrary commands via crafted input. All three vulnerabilities are classified as critical or high risk, with CVSS scores of 9.3 and 8.6 respectively. WatchGuard has released firmware updates to address these issues, and users are urged to apply them immediately. As of the latest reports, there is no evidence that these vulnerabilities have been exploited in the wild. The affected firmware versions are those prior to 3.4.8. WatchGuard has not disclosed specific detection methods for potential attacks. 6 sources 72

Extracted Entities

CVE 2026 86131

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (3)

Domains (1)

Platforms (1)