CVE-2026-86131: Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

Critical severity · published Sep 29, 2026

CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

9.8

CVSS

0.5%

EPSS

On KEV

Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 40% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fireware OS · WatchGuard

2026.3 before 2026.3.2; 2025.0 before 2026.2.3; 12.0 before 12.12.3; 12.0 before 12.5.21 · source: vendor

Fireware · Watchguard

12.0 before 12.5.21; 12.12 before 12.12.3; 2025.0 before 2026.2.3; 2026.3 before 2026.3.2 · source: NVD

In the news

VulnerabilityCritical

WatchGuard fixes critical Fireware OS flaw allowing remote code execution

WatchGuard fixes 15 Fireware OS flaws, including a critical RCE bug that could give attackers root access to vulnerable Firebox appliances. WatchGuard has released security updates for Fireware OS that address 15 vulnerabilities, including a critical code injection flaw, tracked as CVE-2026-86131 (CVSS score of 9.2), that could allow an attacker to execute commands with […]

CVE-2026-86131

Sep 30, 2026·Security Affairs

Affected product

Fireware OS

WatchGuard

All Fireware OS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-86131

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-86131

vendor-advisory

https://psirt.watchguard.com/CVE-2026-86131