CVSS 9.8 (critical) · published 2026-09-30
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Affected products (NVD): watchguard fireware
Fixed in (NVD): 12.5.21, 12.12.3, 2026.2.3, 2026.3.2
Weakness: CWE-94, CWE-295, CWE-829
Source: NVD CVE-2026-86131
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.