by Kastro
Paper/Archive/CVE-2026-86131

CVE-2026-86131

WatchGuard Fireware OS — Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.5.405 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Affected

ProductAffectedFixed inSource
Fireware OS2026.3 – < 2026.3.22026.3.2CNA
Fireware OS2025.0 – < 2026.2.32026.2.3CNA
Fireware OS12.0 – < 12.12.312.12.3CNA
Fireware OS12.0 – < 12.5.2112.5.21CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WatchGuard (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorypsirt.watchguard.com/CVE-2026-86131