WatchGuard patched 15 vulnerabilities in Fireware OS, including a critical code injection flaw (CVE-2026-86131) with a CVSS score of 9.2. This vulnerability arises from improper handling of BOVPN over TLS client configurations, allowing remote attackers controlling the VPN server to execute commands as root on Firebox appliances. The patches also fix 13 high-severity bugs enabling remote code execution, authorization bypass, denial-of-service, unauthorized SSLVPN access, and arbitrary local file reads, plus a medium-severity improper authorization issue. Separately, critical and high-severity vulnerabilities in WatchGuard Access Points were fixed in version 3.4.8, including unauthenticated API session acquisition and OS command injection. WatchGuard is not aware of any active exploitation of these vulnerabilities.

Successful exploitation of CVE-2026-86131 could allow remote attackers controlling a VPN server to execute arbitrary commands with root privileges on Firebox appliances, potentially leading to full system compromise. Other vulnerabilities patched include those enabling remote code execution, denial-of-service, authorization bypass, unauthorized access to SSLVPN, and local file read attacks. The Access Point vulnerabilities could allow unauthenticated attackers to obtain valid API sessions or execute shell commands, increasing risk of device compromise. No known exploitation in the wild has been reported.

WatchGuard has released official patches resolving these vulnerabilities in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21, and in WatchGuard Access Point version 3.4.8. Users should apply these updates promptly to mitigate risk. There are no reports of active exploitation, but timely patching is recommended to prevent potential attacks.