High severity · published Sep 28, 2026
CVE-2026-87969
WatchGuard AP Authenticated Command Injection in Diagnostic CLI
8.6
CVSS
1.4%
EPSS
No
On KEV
Description
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WatchGuard AP · WatchGuard
1.0 before 3.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87969
vendor-advisory
https://psirt.watchguard.com/CVE-2026-87969
More from WatchGuard AP
9.3
CVE-2026-86102
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
9.3
CVE-2026-101891
WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access