Code Injection Vulnerability in WatchGuard Fireware OS's VPN Client Configuration
CVE-2026-86131

9.2CRITICAL

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-86131?

A code injection vulnerability exists in the BOVPN Over TLS client configuration of WatchGuard Fireware OS. This vulnerability permits an attacker, who has control over the remote VPN server, to execute arbitrary commands with root privileges on the connecting Firebox device. Such a security flaw could lead to unauthorized access and manipulation of sensitive systems, making it crucial for users to apply appropriate patches and mitigation strategies.

Affected Version(s)

Fireware OS Default 2026.3 < 2026.3.2

Fireware OS Default 2025.0 < 2026.2.3

Fireware OS Default 12.0 < 12.12.3

References

https://psirt.watchguard.com/CVE-2026-86131
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

btaol
.