Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-86131

Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WatchGuard

Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WatchGuard Fireware OS

Default version status: unaffected

  • 2026.3 to < 2026.3.2affected
  • 2025.0 to < 2026.2.3affected
  • 12.0 to < 12.12.3affected

WatchGuard Fireware OS

Default version status: unaffected

  • 12.0 to < 12.5.21affected

References