CVE-2026-86131
published 2026-09-30CVE-2026-86131: A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.36%
27.6th percentile
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| watchguard | fireware | >= 12.0 < 12.5.21 | 12.5.21 |
| watchguard | fireware | >= 12.12 < 12.12.3 | 12.12.3 |
| watchguard | fireware | >= 2025.0 < 2026.2.3 | 2026.2.3 |
| watchguard | fireware | >= 2026.3 < 2026.3.2 | 2026.3.2 |
| watchguard | fireware_os | >= 12.0 < 12.12.3 | 12.12.3 |
| watchguard | fireware_os | >= 12.0 < 12.5.21 | 12.5.21 |
| watchguard | fireware_os | >= 2025.0 < 2026.2.3 | 2026.2.3 |
| watchguard | fireware_os | >= 2026.3 < 2026.3.2 | 2026.3.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WatchGuard Fireware OS BOVPN Over TLS Client Configuration code injection
vuldb·2026-09-30·CVSS 9.2
CVE-2026-86131 [CRITICAL] WatchGuard Fireware OS BOVPN Over TLS Client Configuration code injection
A vulnerability, which was classified as very critical, was found in WatchGuard Fireware OS. This affects an unknown function of the component BOVPN Over TLS Client Configuration Handler. Executing a manipulation can lead to code injection.
This vulnerability is handled as CVE-2026-86131. The attack can be executed remotely. There is not any exploit available.
GHSA
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on t
ghsa_unreviewed·2026-09-30
CVE-2026-86131 [CRITICAL] CWE-94 A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on t
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
No detection rules found.
No public exploits indexed.
2026-09-30
Published