WatchGuard Patches Critical Fireware OS Code Injection Vulnerability, Affecting Thousands of Organizations Worldwide
In a critical security update issued yesterday, WatchGuard announced patches for 15 vulnerabilities in its Fireware OS operating system, including a high-severity remote code execution (RCE) bug that could allow attackers to execute commands with root privileges on connected appliances. The vulnerability, tracked as CVE-2026-86131, has a CVSS score of 9.2 and is described as a code injection issue in how the operating system handles BOVPN over TLS client configurations.
The security flaw affects Firebox appliances connected to VPN servers controlled by attackers. If exploited, it could grant unauthorized access to sensitive data and allow malicious actors to execute arbitrary commands on the affected device. The vulnerability was resolved in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.
The security updates also addressed 13 high-severity vulnerabilities that could lead to RCE, authorization bypass, denial-of-service (DoS), unauthorized SSLVPN access, and arbitrary local file reads. A medium-severity improper authorization issue leading to unauthorized access to web applications was also fixed. Several of these security defects can be exploited by remote attackers without authentication.
WatchGuard’s patches come just a day after the company released fixes for two critical- and one high-severity Access Point flaws. These vulnerabilities, tracked as CVE-2026-101891 and CVE-2026-86102, affect internal API services and could allow attackers to obtain valid API sessions without authentication and execute arbitrary shell commands on the underlying OS.
While WatchGuard has not reported any exploitation of these security issues in the wild, it’s essential for organizations using Fireware OS to apply the latest patches as soon as possible. With many of these vulnerabilities allowing remote attackers to execute code with root privileges or gain unauthorized access to sensitive data, the risk of exploitation is high.
For users who have yet to update their systems, we recommend taking immediate action to mitigate potential risks. This includes applying the latest security updates and ensuring that all connected appliances are running the most recent version of Fireware OS.
Organizations should also take this opportunity to review their network configurations and ensure they are following best practices for securing VPN connections. By staying proactive in addressing these vulnerabilities, organizations can minimize the risk of a successful attack and protect sensitive data from falling into the wrong hands.
Source: SecurityWeek — 2026-09-30