CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

State: Published
Severity: 9.2 Critical
Published: Sep 29, 2026
Updated: Oct 1, 2026
Reserved: Sep 5, 2026

Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	WatchGuard

Weaknesses

Affected Products

Product	Versions
Fireware OSWatchGuard	2026.3 to before 2026.3.2Affected 2025.0 to before 2026.2.3Affected 12.0 to before 12.12.3Affected
Fireware OSWatchGuard	12.0 to before 12.5.21Affected

References

https://psirt.watchguard.com/CVE-2026-86131vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.