CVE-2026-86131: Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution
Published Sep 29, 2026
·Updated
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.5.21
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Remediation
Information
Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21
Patch Available
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What position must an attacker have to exploit this issue?
The attacker must control the remote VPN server used by the BOVPN Over TLS connection. The vulnerable Firebox is the one connecting to that server.
2
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary commands to be executed as root on the connecting Firebox.