CVE-2026-86102

Published on September 28, 2026

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Weakness type (CWE)CWE-78, CWE-863

Vulnerabilities

Malicious VPN Server Could Seize Root Control of WatchGuard Firebox Appliances

WatchGuard patched 15 Fireware OS flaws, including critical CVE-2026-86131 for root RCE via malicious BOVPN over TLS server.

Sep 30, 202623:275 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Malicious VPN Server Could Seize Root Control of WatchGuard Firebox Appliances