Reported by 6 outlets

Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 6 sources
Authority: 1.20 / 2.0 · best outlet weight
Severity: 4.50 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.60 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

cyberpress.orgpsirt.watchguard.comgbhackers.commalware.newsbeyondmachines.netsecurityonline.info CVE-2026-101891CVE-2026-86102CVE-2026-87969 desk first seen 15d ago

Desk analysis

WatchGuard has patched three vulnerabilities in its access point platform, fixed in AP firmware 3.4.8 and disclosed September 28, 2026. Firmware versions 1.0 through 3.4.7 are affected. CVE-2026-86102 is an unauthenticated OS command injection in the internal management API service with a CVSS v4 score of 9.3: an attacker with network access to a vulnerable AP can run arbitrary shell commands with the privileges of the API service, no credentials or interaction required. CVE-2026-101891, also 9.3, is an improper access control flaw in the same API service that allows unauthenticated access. CVE-2026-87969, rated 8.6, is an authenticated command injection in the diagnostic CLI. The Canadian Centre for Cyber Security echoed the advisory as AV26-972 on September 29.

The serious scenario is an access point reachable from an untrusted, poorly segmented, or remote-access network, where the access control bypass and command injection chain gives a silent foothold inside the corporate network. Wireless infrastructure is frequently deployed on flat management VLANs and patched on slow cycles, which makes exposed AP management interfaces the practical risk.

There is no report of exploitation so far, so the window to patch is open. Watch for PoC code, mass scanning of WatchGuard AP management endpoints, and any vendor note on whether cloud-managed fleets auto-update. Organizations running WatchGuard APs should move to 3.4.8 and restrict management API reachability in the meantime.

Timeline

original reporting

Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

cyberpress.org · 14d ago · September 29th, 2026

WatchGuard has disclosed three vulnerabilities in its wireless access point platform, including two critical flaws that could let an unauthenticated network attacker gain API access and execute arbitrary shell commands . The issues affect WatchGuard AP firmware versions 1.0 through 3.4.7 and were fixed in version 3.4.8, which organizations should deploy immediately. Published on September 28, 2026, the vulnerabilities are tracked as CVE-2026-86102, CVE-2026-101891, and CVE-2026-87969. The first two issues received critical CVSS v4.0 scores of 9.3, while the third was rated high severity at 8.6. Critical WatchGuard AP Flaws The combination of unauthenticated access control bypass and command injection poses a serious risk to organizations where AP management services are accessible from untrusted, poorly segmented, or remote-access networks. CVE-2026-86102 is the most immediately dangerous issue. The flaw is an OS command injection vulnerability in the WatchGuard AP internal management API service. An attacker with network access to a vulnerable access point can submit crafted input that causes arbitrary shell commands to execute on the device’s underlying operating system. Authentication and user interaction are not required. Successful exploitation can give an attacker execution capabilities with the privileges assigned to the API service. In practice, compromise of a wireless access point can create an operational foothold inside a corporate network, potentially allowing an
update from psirt.watchguard.com

CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

psirt.watchguard.com · 15d ago · September 28th, 2026

Published a day before the Fireware OS batch, this critical (CVSS 9.3) advisory covers improper access control in the WatchGuard AP API service allowing unauthenticated access, affecting AP firmware 1.0 and later before 3.4.8 and fixed in 3.4.8. It landed alongside CVE-2026-86102, command injection in the internal management API (CVSS 9.3), and CVE-2026-87969, authenticated command injection in the diagnostic CLI (CVSS 8.6), all fixed in AP 3.4.8. Per WatchGuard, the critical pair can yield a valid API session without authentication and arbitrary shell commands on the underlying OS.
update from watchguard.com

CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution

watchguard.com · 15d ago · September 28th, 2026

Credited to researcher Yukusawa, with no exploitation known to WatchGuard.
update from watchguard.com

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

watchguard.com · 15d ago · September 28th, 2026

Credited to Carlos Garrido of Pentraze Cybersecurity, with no exploitation known to WatchGuard.
update from securityonline.info

WatchGuard patched critical WatchGuard AP vulnerabilities allowing OS command injection. Update your access points to version 3.4.8 to preve

securityonline.info · 15d ago · September 29th, 2026

Update your access points to version 3.4.8 to preve

via Mastodon https://securityonline.info/watchguard-ap-vulnerabilities-patch/?utm_source=mastodon&utm_medium=jetpack_social
update from gbhackers.com

Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

gbhackers.com · 14d ago · September 29th, 2026

These vulnerabilities affect WatchGuard AP firmware versions 1.0 through 3.4.7 and were addressed in version 3.4.8, which the vendor released as a […] The post Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
update from malware.news

WatchGuard security advisory (AV26-972)

malware.news · 14d ago · September 29th, 2026

Serial number: AV26-972 Date: September 29, 2026 As of September 28, 2026, WatchGuard is affected by vulnerabilities in the following product: WatchGuard AP Prior to 3.4.8 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
update from beyondmachines.net

WatchGuard Patches Critical Authentication Bypass and Command Injection Flaws in Access Points WatchGuard patched three vulnerabilities in i

beyondmachines.net · 14d ago · September 29th, 2026

WatchGuard Patches Critical Authentication Bypass and Command Injection Flaws in Access Points WatchGuard patched three vulnerabilities in i

via Mastodon https://beyondmachines.net/event_details/watchguard-patches-critical-authentication-bypass-and-command-injection-flaws-in-access-points-7-0-t-3-k/gD2P6Ple2L