Security
Loading…

CVE-2026-86131

CRITICALCVSS 9.8
View on NVD← Back to search
Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Timeline
Published:September 30th, 2026 12:16 AM
Last modified:October 6th, 2026 8:39 PM
CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software
From NVD CPE configuration data

Vendors

watchguard

Products

fireware
Weaknesses (CWE)
CWE-94CWE-295CWE-829
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute