Reported by 4 outlets

Timeline

1. original reporting

   CRITICAL RCE (CVE-2026-86131) in WatchGuard Fireware OS enables root code execution via BOVPN over TLS. Multiple high-severity flaws also pa

   radar.offseq.com · 13d ago · September 30th, 2026

   CRITICAL RCE (CVE-2026-86131) in WatchGuard Fireware OS enables root code execution via BOVPN over TLS. Multiple high-severity flaws also pa

   via Mastodon https://radar.offseq.com/threat/watchguard-patches-critical-fireware-os-code-injection-vulnerability-36035f2a6c97cfc4

2. update from psirt.watchguard.com

   CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

   psirt.watchguard.com · 14d ago · September 29th, 2026

   WatchGuard's advisory for CVE-2026-86131 (CVSS v4.0 9.2) describes a CWE-94 code injection in Fireware OS BOVPN over TLS client configuration handling, listing CWE-295 improper certificate validation and CAPEC-94 adversary-in-the-middle. An attacker who controls the remote VPN server can execute arbitrary commands as root on the connecting Firebox. Affected ranges are 2026.3 before 2026.3.2, 2025.0 before 2026.2.3, 12.0 before 12.12.3, and 12.0 before 12.5.21 on T15/T35, with fixed builds 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. The vendor credits researcher btaolfinder, states it is not aware of exploitation in the wild, and its RSS feed shows fourteen of the other Fireware advisories in this batch published within the same second.

3. update from securityweek.com

   WatchGuard Patches Critical Fireware OS Code Injection Vulnerability

   securityweek.com · 13d ago · September 30th, 2026

   WatchGuard on Tuesday announced fixes for 15 vulnerabilities in Fireware OS, including a critical-severity remote code execution (RCE) bug. Tracked as CVE-2026-86131 (CVSS score of 9.2), the flaw is described as a code injection issue in how the operating system handles BOVPN over TLS client configurations. The security weakness was resolved in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. The security updates also resolve 13 high-severity vulnerabilities that could lead to RCE, authorization bypass, denial-of-service (DoS), unauthorized SSLVPN access, and arbitrary local file reads. A medium-severity improper authorization issue leading to unauthorized access to web applications was also addressed. Several of these security defects could be exploited by remote attackers without authentication. The Fireware OS patches landed one day after WatchGuard rolled out fixes for two critical- and one high-severity Access Point flaws. Tracked as CVE-2026-101891 and CVE-2026-86102 and affecting internal API services, the critical issues could be exploited to obtain a valid API session without authentication and execute arbitrary shell commands on the underlying OS. The high-severity weakness is an OS command injection that requires administrative privileges for ex

4. update from beyondmachines.net

   WatchGuard Patches Multiple Flaws, One Critical in Fireware OS WatchGuard patched 15 Fireware OS vulnerabilities, the worst a critical code

   beyondmachines.net · 12d ago · October 1st, 2026

   WatchGuard Patches Multiple Flaws, One Critical in Fireware OS WatchGuard patched 15 Fireware OS vulnerabilities, the worst a critical code

   via Mastodon https://beyondmachines.net/event_details/watchguard-patches-multiple-flaws-one-critical-in-fireware-os-w-l-q-u-2/gD2P6Ple2L