Critical Command Injection and Authentication Flaws in WatchGuard Access Points

• •Three critical vulnerabilities in WatchGuard APs allow command injection and authentication bypass.
• •Firmware versions prior to 3.4.8 are affected; updates are available to mitigate risks.
• •No confirmed exploitation of the vulnerabilities has been reported as of now.

Three critical vulnerabilities have been identified in WatchGuard's access points, allowing attackers to execute arbitrary commands and bypass authentication. The flaws include CVE-2026-101891, which permits unauthenticated access to a valid API session, and CVE-2026-86102, enabling command injection through the internal API service. The third vulnerability, CVE-2026-87969, allows authenticated administrators to execute arbitrary commands via crafted input. All three vulnerabilities are classified as critical or high risk, with CVSS scores of 9.3 and 8.6 respectively. WatchGuard has released firmware updates to address these issues, and users are urged to apply them immediately. As of the latest reports, there is no evidence that these vulnerabilities have been exploited in the wild. The affected firmware versions are those prior to 3.4.8. WatchGuard has not disclosed specific detection methods for potential attacks.