Critical WatchGuard API Vulnerabilities Enable Command Execution Attacks
WatchGuard has released firmware version 3.4.8 to address two critical OS command injection and improper access control flaws, CVE-2026-86102 and CVE-2026-101891, allowing unauthenticated remote command execution on AP devices.
WatchGuard has disclosed three security vulnerabilities affecting its AP devices, including two critical flaws that could allow attackers to gain unauthenticated access and execute commands on vulnerable access points. Organizations using WatchGuard AP firmware earlier than version 3.4.8 should apply the available update immediately.
The vulnerabilities, published on September 28, 2026, affect WatchGuard AP versions from 1.0 through 3.4.7. WatchGuard addressed all three issues in version 3.4.8. The most serious issue, tracked as CVE-2026-86102, carries a CVSS v4 score of 9.3. This vulnerability is an OS command injection flaw in the internal management API service. An attacker with network access to a vulnerable WatchGuard AP could send crafted input to trigger arbitrary shell command execution on the underlying operating system. Crucially, no authentication or user interaction is required, making the bug especially dangerous where the affected API service is reachable from untrusted networks.
A second critical vulnerability, CVE-2026-101891, also rated 9.3, stems from improper access control in an internal API service on WatchGuard access points. This flaw allows an unauthenticated attacker with network access to access functionality that should be protected. This could provide a pathway for attackers to interact with internal management capabilities and potentially support follow-on compromise attempts against the device or connected environment.
The third vulnerability, CVE-2026-87969, is a high-severity command injection issue with a CVSS v4 score of 8.6. Unlike the two critical flaws, exploitation requires authenticated administrator privileges. A malicious or compromised administrator account could supply crafted input through the diagnostic command-line interface and execute arbitrary operating system commands on the WatchGuard AP.
Command injection vulnerabilities are particularly serious in network appliances because compromised access points can become a foothold inside enterprise networks. Attackers may use command execution to collect configuration data, modify device settings, deploy persistence mechanisms, intercept network traffic, or attempt lateral movement toward other systems. Devices exposed through management networks, remote-access paths, or poorly segmented wireless infrastructure may face greater risk.
Security teams should first identify all deployed WatchGuard AP devices and verify their firmware versions, prioritizing upgrades for devices running a release earlier than 3.4.8. Administrators should also restrict access to AP management interfaces and internal API services, ensuring they are only reachable from trusted administrative networks. Reviewing access logs, administrative activity, diagnostic CLI usage, and configuration changes for signs of unexpected activity is also recommended.
Organizations should rotate administrative credentials if there is any indication that an AP management account may have been exposed. Network segmentation can further reduce the impact of a compromised wireless device by limiting its ability to communicate with critical internal systems.
While there is currently no public evidence of active exploitation or a publicly available proof-of-concept for these vulnerabilities, the unauthenticated nature and critical severity of the internal API flaws make rapid patching essential for all WatchGuard AP deployments.
This new report details an additional critical code injection vulnerability, CVE-2026-86131, affecting WatchGuard's Fireware OS. The flaw, with a CVSS score of 9.2, specifically targets the handling of BOVPN over TLS client configurations and could allow a remote attacker to execute commands with root privileges on the connecting Firebox appliance. Patches for this vulnerability have been released for several Fireware OS versions, including 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.
This new advisory details a deserialization vulnerability within the samld component of WatchGuard FireWare OS, specifically CVE-2026-13046. Unlike the previously reported command injection flaws in WatchGuard's API, this vulnerability requires an attacker to first gain write access to the samld session directory to achieve remote code execution. The Zero Day Initiative has assigned this flaw a CVSS score of 7.5.
This new advisory details a specific stack-based buffer overflow vulnerability, CVE-2026-18145, within the spamd statushdlr component of WatchGuard FireWare OS. Unlike the previously reported API vulnerabilities, this flaw requires authentication and allows for remote code execution with a CVSS score of 7.2, impacting a different functional area of the WatchGuard product.