WatchGuard has officially released security updates addressing 15 distinct vulnerabilities across its Fireware OS line. The patch release is highlighted by a critical remote code execution flaw that directly impacts Firebox network security appliances. Designated as CVE-2026-86131, this severe vulnerability received a CVSS severity score of 9.2. It stems from a critical code injection weakness discovered within the operating system's mechanism for handling BOVPN over TLS client configurations.
Root-Level Privileges and Additional OS Fixes
When successfully exploited, this critical flaw allows a remote attacker who controls a malicious or compromised VPN server to execute arbitrary code with elevated root privileges on any connecting Firebox device. To mitigate these risks, WatchGuard implemented targeted fixes across multiple Fireware OS versions, specifically builds 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. System administrators are urged to apply these updates promptly to protect peripheral network infrastructure.
In addition to the primary critical bug, the security update resolves 13 high-severity vulnerabilities. These secondary defects introduce serious risks including remote code execution, authorization bypasses, denial-of-service conditions, unauthorized SSLVPN access, and arbitrary local file reads. WatchGuard also patched a medium-severity improper authorization issue impacting web application access. Notably, several of the resolved flaws could be exploited remotely by unauthenticated attackers without prior access.
Access Point Vulnerabilities Patched
The Fireware OS deployment follows related security updates issued for WatchGuard Access Point hardware running software version 3.4.8. Those patches addressed two critical security vulnerabilities, tracked as CVE-2026-101891 and CVE-2026-86102. If left unpatched, these bugs would permit unauthenticated attackers to acquire valid internal API session tokens and execute arbitrary shell commands on affected hardware.
The 3.4.8 release also fixed an additional high-severity OS command injection flaw, though exploiting that specific bug required pre-existing administrator privileges. WatchGuard confirmed that none of the disclosed vulnerabilities across its Fireware OS or Access Point products have been actively exploited in wild attacks prior to the patch announcement. Nevertheless, immediate updates remain recommended.
AI-generated editorial illustration; not a documentary photograph.
Source: WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
SIGNAL TITANS
Leave a Reply