WatchGuard's BOVPN over TLS bug gives the far-end server root on connecting Fireboxes
WatchGuard patched CVE-2026-86131, a 9.2-rated Fireware OS bug letting whoever controls a BOVPN over TLS server run root commands on connecting Fireboxes. The Firebox at risk is the tunnel client, and its safety depends on who controls the server it dials.
The Watch · Security desk
What happened
- The fix ships in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21, and earlier versions on those branches are affected depending on platform.
- The same release closes 13 high-severity flaws covering code execution, authorization bypass, denial of service, SSLVPN access and file reads, plus one medium-severity bug.
- WatchGuard separately fixed two critical access point flaws, CVE-2026-101891 and CVE-2026-86102, that yield an unauthenticated API session and shell commands, in AP 3.4.8.
- WatchGuard says it is not aware of any of the Fireware OS or access point flaws being exploited in the wild.
Why it matters
- exposure Until patched, a Firebox that tunnels to a server someone else operates gives that operator, or whoever compromises them, a route to root on the client.
- decision Tunnel role sets the patch order; Security Affairs puts boxes with BOVPN over TLS enabled first, and fleets without the feature can time the update to the high-severity bugs.
- cost Shops running both WatchGuard access points and Fireboxes face two separate upgrades in two days: AP 3.4.8 and a Fireware OS release matched to each branch.
The flaw is in the client. "A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox," the advisory reads [2]. Exploitation needs no user interaction and no prior privileges [3]. It does need control of the remote VPN server [3].
BOVPN over TLS is a client-server feature for building tunnels between Firebox appliances [9]. The server end is normally another Firebox. The feature can carry VPN traffic over TCP port 443, a port firewalls commonly allow, and is used where IPsec traffic cannot easily get through [10]. An attacker who compromises the Firebox acting as server can use it to run root commands on each Firebox that connects to it as a client [2][9]. The reports do not say whether a client can be steered to an attacker-built server without first compromising the real one.
The score is 9.2 [1]. In practice the bug is out of reach for an attacker scanning the internet and in reach for one who already holds a BOVPN over TLS server [3]. The rest of the release differs in who can reach it. CVE-2026-81433, rated 8.7, needs a position on the adjacent network and a crafted DHCP packet sent to the fingerd daemon, and yields code execution or a crash [12]. CVE-2026-86101, rated 7.2, needs an authenticated SAML user with Access Portal access, who can then obtain Mobile VPN with SSL access through a crafted request [11]. SecurityWeek reports that several of the fixed flaws can be exploited remotely without authentication [13].
WatchGuard shipped the access point fixes on September 28 [17] and the Fireware OS updates the next day, Tuesday, September 29 [7][8]. WatchGuard recommends customers update affected Firebox appliances to the appropriate patched release [15].
What to watch
- Any report of CVE-2026-86131 or the unauthenticated remote Fireware flaws being exploited, which WatchGuard says it has not seen.
- Whether WatchGuard or researchers say a BOVPN over TLS client can be pointed at an impostor server without compromising the real one.
- Which of the 13 high-severity flaws are the remotely exploitable, unauthenticated ones SecurityWeek describes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
WatchGuard released Fireware OS security updates addressing 15 vulnerabilities, including a critical code injection flaw, CVE-2026-86131 (CVSS 9.2), that could allow an attacker to execute commands with root privileges on a vulnerable Firebox.
- [2]
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
- [3]
The attack requires the threat actor to control the remote VPN server to which the vulnerable Firebox connects; it does not require user interaction or prior privileges.
- [4]
CVE-2026-86131 is fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21; affected branches include Fireware versions below those releases, depending on platform.
- [5]
The updates also fix 13 high-severity vulnerabilities that could lead to remote code execution, authorization bypass, denial of service, unauthorized SSLVPN access and arbitrary file reads, plus a medium-severity authorization issue allowing unauthorized access to web applications.
- [6]
WatchGuard says it is not aware of any of the Fireware OS or Access Point vulnerabilities being exploited in the wild.
- [7]
Security Affairs dates the Fireware OS security updates to September 29.
- [8]
WatchGuard announced the Fireware OS fixes on Tuesday, one day after it rolled out fixes for Access Point flaws.
- [9]
BOVPN over TLS uses a client-server model and is a feature used to create VPN tunnels between WatchGuard Firebox appliances.
- [10]
BOVPN over TLS can send VPN traffic over TCP port 443, a port commonly allowed through network firewalls, making it useful where traditional IPsec traffic cannot easily pass.
- [11]
CVE-2026-86101 (CVSS 7.2) is an improper authorization flaw in the SAML login process that lets a remote authenticated SAML user with access only to the Access Portal obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
- [12]
CVE-2026-81433 (CVSS 8.7) is a stack-based buffer overflow in the DHCP fingerprinting daemon (fingerd) that lets an unauthenticated attacker with adjacent network access execute arbitrary code or crash the process with a specially crafted DHCP packet.
- [13]
Several of the Fireware OS vulnerabilities could be exploited by remote attackers without authentication.
- [14]
WatchGuard fixed two critical Access Point flaws in internal API services, CVE-2026-101891 and CVE-2026-86102, that could be exploited to obtain a valid API session without authentication and execute arbitrary shell commands on the underlying OS, plus a high-severity OS command injection requiring administrative privileges; all three are resolved in WatchGuard AP version 3.4.8.
- [15]
WatchGuard recommends customers update affected Firebox appliances to the appropriate patched release.
- [16]
Organizations using Firebox appliances should review their Fireware OS versions and prioritize the September 29 security updates, particularly where BOVPN over TLS is enabled.
- [17]
WatchGuard's Access Point fixes shipped on September 28.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comWatchGuard fixes critical Fireware OS flaw allowing remote code execution
1 article · September 30, 2026
- securityweek.comWatchGuard Patches Critical Fireware OS Code Injection Vulnerability
1 article · September 30, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- VPN securityFollow
- Network appliance vulnerabilitiesFollow