CVE-2026-86131: Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution
Analyzed
Published 29-09-2026Last modified 01-10-2026
Vulnerability summary
CVE-2026-86131 is a critical (CVSS 9.8) Code Injection vulnerability in watchguard fireware. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · Change unavailableKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 29-09-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST9.2CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
30-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Affected systems
Watchguard2 products
- fireware≥ 12.0, < 12.5.21 | ≥ 12.12, < 12.12.3 | ≥ 2025.0, < 2026.2.3 | ≥ 2026.3, < 2026.3.2
- fireware os≥ 2026.3, < 2026.3.2 | ≥ 2025.0, < 2026.2.3 | ≥ 12.0, < 12.12.3 | ≥ 12.0, < 12.5.21
1 vendor · 2 products