WatchGuard patches critical Fireware code-injection bug

WatchGuard on Tuesday released patches for Fireware OS to address CVE-2026-86131, a code-injection vulnerability with a CVSS score of 9.2. The flaw could allow a remote VPN server to execute commands with root privileges on a Firebox appliance that connects as a TLS client.

The bug exists in how Fireware handles Branch Office VPN (BOVPN) over TLS client configurations. If an attacker controls the remote VPN server and sends crafted data, the client-side parsing can trigger command execution at the highest privilege level on the appliance.

The fixes are included in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. WatchGuard wrote the updates resolve 15 vulnerabilities in total, including 13 high-severity issues that could lead to remote code execution, authorization bypass, denial-of-service, unauthorized SSLVPN access and arbitrary local file reads, plus one medium-severity improper authorization bug affecting hosted web applications.

Several of the patched defects can be exploited remotely without authentication. The Fireware fixes were published one day after WatchGuard released patches for its Access Point software. Those AP fixes, in version 3.4.8, addressed two critical flaws tracked as CVE-2026-101891 and CVE-2026-86102 that affected internal API services and could be used to obtain a valid API session without authentication and to run shell commands on the underlying operating system. A separate high-severity AP issue required administrative privileges to exploit.

WatchGuard wrote that it is not aware of any of the issues being exploited in the wild and published technical details and remediation steps on its security advisories page.

Firebox appliances run Fireware OS and are used to provide firewall and VPN services for remote offices and mobile users. Root-level command execution on a Firebox would grant full control of the device and access to its system files and network interfaces.

Network administrators should check whether their Firebox models and Fireware versions are listed in the advisories and install the provided updates.