# WatchGuard Fireware OS Critical Code Injection Vulnerability in BOVPN over TLS Client (CVE-2026-86131)

> WatchGuard patched a critical code injection flaw (CVE-2026-86131, CVSS 9.2) in how Fireware OS handles BOVPN over TLS client configurations, letting a remote attacker who controls a VPN server execute root-level commands on connecting Firebox appliances. The same update fixes 13 high-severity and 1 medium-severity vulnerabilities; WatchGuard reports no evidence of in-the-wild exploitation.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2813
- **ID:** TL-2026-2813
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-86131, CVE-2026-86134, CVE-2026-86104, CVE-2026-18145, CVE-2026-81433, CVE-2026-13046, CVE-2026-86101, CVE-2026-101891, CVE-2026-86102, CVE-2026-95676, CVE-2025-9242

## Description

WatchGuard advisory CVE-2026-86131, titled 'Code Injection in BOVPN Over TLS Client Allows Remote Code Execution', was published on 2026-09-29 by WatchGuard PSIRT with a CVSS score of 9.2 (Critical) and a weakness class of code injection (CWE-94). The flaw sits in the way Fireware OS processes configuration delivered to a BOVPN over TLS client. A remote attacker who controls the VPN server a Firebox connects to can inject commands that execute with root privileges on the appliance, without authenticating to the firewall itself.

Affected versions per the advisory: on the default platform set, Fireware OS >= 2026.3 and < 2026.3.2, >= 2025.0 and < 2026.2.3, and >= 12.0 and < 12.12.3; on T15/T35 models, >= 12.0 and < 12.5.21. Fixed releases are Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.

The same release train fixes 13 further high-severity flaws and 1 medium-severity flaw. Per SecurityWeek, the high-severity flaws cover remote code execution, authorization bypass, denial of service, unauthorized SSLVPN access and arbitrary local file reads, and several could be exploited by remote attackers without authentication; the medium flaw is improper authorization leading to unauthorized web application access. The WatchGuard PSIRT index for September 2026 lists: CVE-2026-86134 (pre-authentication NULL pointer dereference, remote DoS, CVSS 8.7, published 2026-09-30), CVE-2026-86104 (resource exhaustion in the login process, DoS, CVSS 8.7), CVE-2026-18145 (stack-based buffer overflow in spamd, RCE, CVSS 8.6), CVE-2026-81433 (pre-authentication stack buffer overflow in fingerd, RCE, CVSS 8.7), CVE-2026-13046 (deserialization of untrusted data in samld, RCE, CVSS 7.5) and CVE-2026-86101 (authorization bypass in SAML login allowing unauthorized SSLVPN access, CVSS 7.2). The full enumeration of the 13 high-severity flaws was not available in the sources; the per-advisory pages returned HTTP 403 to automated fetches.

WatchGuard also fixed two critical access point flaws in AP firmware 3.4.8 (advisories published 2026-09-28): CVE-2026-101891 (improper access control in the API service allowing unauthenticated access, CVSS 9.3) and CVE-2026-86102 (command injection in the internal management API, CVSS 9.3), which together permit unauthenticated API session acquisition and arbitrary shell command execution. A high-severity OS command injection requiring administrative privileges was fixed in the same AP release. Separately, CVE-2026-95676 (CVSS 7.4, published 2026-09-23) fixes a first-factor authentication bypass in the AuthPoint Gateway LDAP sync.

WatchGuard states it is not aware of in-the-wild exploitation of these issues. No public PoC, no network or file IOCs and no CVSS vector string were available in the sources reviewed. Firebox appliances are perimeter devices and WatchGuard VPN flaws have been targeted before (for example CVE-2025-9242, an IKEv2 out-of-bounds write with CVSS 4.0 9.3, disclosed October 2025), so prompt patching is recommended.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1005 Data from Local System
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [WatchGuard Patches Critical Fireware OS Code Injection Vulnerability](https://www.securityweek.com/watchguard-patches-critical-fireware-os-code-injection-vulnerability/)
- [WatchGuard PSIRT](https://psirt.watchguard.com/)
- [WatchGuard PSIRT advisory CVE-2026-86131](https://psirt.watchguard.com/advisories/CVE-2026-86131)
- [WatchGuard PSIRT advisory CVE-2026-18145 (spamd stack overflow)](https://psirt.watchguard.com/advisories/CVE-2026-18145)
- [WatchGuard PSIRT advisory CVE-2026-101891 (AP API access control)](https://psirt.watchguard.com/advisories/CVE-2026-101891)
- [NVD - CVE-2026-86131](https://nvd.nist.gov/vuln/detail/CVE-2026-86131)
- [Fireware Release Notes v2026.3](https://www.watchguard.com/support/release-notes/fireware/2026/en_US/2026_3/Fireware_Release-Notes_v2026_3.pdf)
- [Fireware Release Notes v2026.2](https://www.watchguard.com/support/release-notes/fireware/2026/en_US/2026_2/Fireware_Release-Notes_v2026_2.pdf)
- [WatchGuard Fireware v2026.2, 12.12 and 12.5.18 now available](https://www.watchguard.com/wgrd-blog/watchguard-fireware-v20262-1212-and-12518-now-available)
- [Critical WatchGuard Fireware OS Flaw Enables Remote Code Execution (CVE-2025-9242, related prior VPN flaw)](https://www.infosecurity-magazine.com/news/watchguard-fireware-os-flaw/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2813