Critical severity · published Sep 28, 2026
CVE-2026-86102
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
9.3
CVSS
2.3%
EPSS
No
On KEV
Description
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WatchGuard AP · WatchGuard
1.0 before 3.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86102
vendor-advisory
https://psirt.watchguard.com/CVE-2026-86102
More from WatchGuard AP
9.3
CVE-2026-101891
WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
8.6
CVE-2026-87969
WatchGuard AP Authenticated Command Injection in Diagnostic CLI