WatchGuard Patches Critical Fireware OS Code Injection Vulnerability

WatchGuard on Tuesday announced fixes for 15 vulnerabilities in Fireware OS, including a critical-severity remote code execution (RCE) bug.

Tracked as CVE-2026-86131 (CVSS score of 9.2), the flaw is described as a code injection issue in how the operating system handles BOVPN over TLS client configurations.

Successful exploitation could allow a remote attacker who controls the remote VPN server to execute commands with root privileges on the connecting Firebox appliance.

The security weakness was resolved in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.

The security updates also resolve 13 high-severity vulnerabilities that could lead to RCE, authorization bypass, denial-of-service (DoS), unauthorized SSLVPN access, and arbitrary local file reads.

A medium-severity improper authorization issue leading to unauthorized access to web applications was also addressed.

Several of these security defects could be exploited by remote attackers without authentication.

The Fireware OS patches landed one day after WatchGuard rolled out fixes for two critical- and one high-severity Access Point flaws.

Tracked as CVE-2026-101891 and CVE-2026-86102 and affecting internal API services, the critical issues could be exploited to obtain a valid API session without authentication and execute arbitrary shell commands on the underlying OS.

The high-severity weakness is an OS command injection that requires administrative privileges for exploitation. All three vulnerabilities were resolved in WatchGuard AP version 3.4.8.

According to WatchGuard, it is not aware of any of these security issues being exploited in the wild. Additional information can be found on the company’s security advisories page.

Related: Chrome, Firefox Updates Patch Over 100 Vulnerabilities

Related: Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

Related: Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

Related: ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Reco Raises $55 Million for Agentic Security

Hackers Use ChatGPT Custom GPTs in ClickFix Attacks

Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

DC Health Agency Exposes 400,000 Beneficiary Records

Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability

Google: AI Is Changing the Pace and Profile of Vulnerability Discovery

Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

Chrome, Firefox Updates Patch Over 100 Vulnerabilities

Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

ShinyHunters Defiant After FBI Calls on Members to Come Forward

High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL

Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development

Flipboard Whatsapp Whatsapp Email