Vulnerability intelligence
CVE-2026-86131
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
CVSS Score
9.2
Critical
EPSS — Exploit Probability
—
Awaiting FIRST.org data · checked 2026-09-30
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Sep 30, 2026 · latest Sep 30, 2026
Coverage timeline
-
WatchGuard Patches Firebox Flaws Enabling Unauthenticated Remote Code Executionsecurityonline.info · Sep 30, 2026