CVE 2026 87969

psirt.watchguard.com • September 29, 2026

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

Weakness Type and Impact #

CWE CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CAPEC CAPEC-88 OS Command Injection

Exploitation Status #

WatchGuard thanks Carlos Garrido of Pentraze Cybersecurity for working with us to protect our customers finder

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection and Authentication Flaws in WatchGuard Access Points Three critical vulnerabilities have been identified in WatchGuard's access points, allowing attackers to execute arbitrary commands and bypass authentication. The flaws include CVE-2026-101891, which permits unauthenticated access to a valid API session, and CVE-2026-86102, enabling command injection through the internal API service. The third vulnerability, CVE-2026-87969, allows authenticated administrators to execute arbitrary commands via crafted input. All three vulnerabilities are classified as critical or high risk, with CVSS scores of 9.3 and 8.6 respectively. WatchGuard has released firmware updates to address these issues, and users are urged to apply them immediately. As of the latest reports, there is no evidence that these vulnerabilities have been exploited in the wild. The affected firmware versions are those prior to 3.4.8. WatchGuard has not disclosed specific detection methods for potential attacks. 4 sources 72

Extracted Entities

CVE 2026 87969

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)