WatchGuard Patches Critical Fireware OS Code-Injection Flaw
Summary
WatchGuard patched 15 Fireware OS vulnerabilities, including a critical code-injection flaw that could let an attacker controlling a remote VPN server execute commands as root on a connecting Firebox. The company reports no known exploitation.
Key points
- CVE-2026-86131 is a critical code-injection vulnerability in handling BOVPN over TLS client configurations, rated CVSS 9.2.
- An attacker controlling the remote VPN server could exploit the flaw to execute commands with root privileges on a connecting Firebox appliance.
- The Fireware OS fixes are available in versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.
- The Fireware updates also address 13 high-severity flaws involving RCE, authorization bypass, DoS, unauthorized SSLVPN access, and local file reads, plus a medium-severity authorization issue.
- Several of the Fireware vulnerabilities could be exploited remotely without authentication.
- Separate WatchGuard Access Point updates fix two critical vulnerabilities that could enable unauthenticated API session access and shell command execution, and a high-severity command-injection flaw; all are fixed in version 3.4.8.
- WatchGuard says it is not aware of exploitation of the reported issues.
Article Details
- Vulnerability Types
- Code injection
- Remote code execution
- Authorization bypass
- Denial of service
- Unauthorized SSLVPN access
- Arbitrary local file read
- Improper authorization
- OS command injection
- Severity
- Critical (CVSS 9.2) for CVE-2026-86131; other patched issues were high or medium severity.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-101891Tracked as CVE-2026-101891 and CVE-2026-86102 and affecting internal API services, the critical issues could be exploited to obtain a valid API session without authentication and execute arbitrary shell commands on theCVE-2026-86102Tracked as CVE-2026-101891 and CVE-2026-86102 and affecting internal API services, the critical issues could be exploited to obtain a valid API session without authentication and execute arbitrary shell commands on theCVE-2026-86131Tracked as CVE-2026-86131 (CVSS score of 9.2), the flaw is described as a code injection issue in how the operating system handles BOVPN over TLS client configurations.
Vendors
Products
FireboxSuccessful exploitation could allow a remote attacker who controls the remote VPN server to execute commands with root privileges on the connecting Firebox appliance.Fireware OSWatchGuard on Tuesday announced fixes for 15 vulnerabilities in Fireware OS, including a critical-severity remote code execution (RCE) bug.WatchGuard APAll three vulnerabilities were resolved in WatchGuard AP version 3.4.8.