CVEvulnerability

CVE-2026-86131

9.2 CRITICAL Published 2026-09-30 Modified 2026-10-06 Official page ↗
Status
Analyzed
Published
2026-09-30
Last modified
2026-10-06
Assigner
5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS 4.0 (5d1c2695-1a31-4499-88ae-e847036fd7e3)
9.2 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295, CWE-829, CWE-94

Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Affected configurations

• watchguard fireware (>= 12.0 < 12.5.21) • watchguard fireware (>= 12.12 < 12.12.3) • watchguard fireware (>= 2025.0 < 2026.2.3) • watchguard fireware (>= 2026.3 < 2026.3.2)

Related

Weakness · CWE (3)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
  • CWE-94 Improper Control of Generation of Code weakness

References