WatchGuard Patches Critical Fireware OS Code Injection Vulnerability

WatchGuard has released updates addressing 15 vulnerabilities in Fireware OS, the most serious being a critical code-injection flaw tracked as CVE-2026-86131 with a CVSS score of 9.2. The bug lies in how the OS processes BOVPN over TLS client settings, letting an attacker controlling the remote VPN server run commands as root on a connected Firebox device. The fix ships in Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21, alongside patches for 13 high-severity issues (covering RCE, auth bypass, DoS, unauthorized SSLVPN access, and arbitrary file reads) and one medium-severity authorization flaw affecting web app access. A day earlier, WatchGuard also patched two critical and one high-severity flaw in its Access Point firmware — CVE-2026-101891 and CVE-2026-86102 allow unauthenticated attackers to hijack API sessions and run shell commands, while the high-severity bug needs admin rights for OS command injection; all three are fixed in WatchGuard AP 3.4.8. The vendor says none of these flaws have been exploited in the wild so far.