A malicious VPN server could turn a WatchGuard Firebox connection into root-level command execution. WatchGuard disclosed CVE-2026-86131 on Sept. 29, rating the Fireware OS vulnerability critical at 9.2 under CVSS v4.
The flaw affects BOVPN over TLS client configurations and lets an attacker controlling the remote VPN server execute arbitrary commands as root on the connecting Firebox. WatchGuard says it has not observed exploitation in the wild.
Exploitation requires the Firebox to connect to an attacker-controlled VPN server rather than an attacker directly targeting an exposed appliance service. WatchGuard's CVE-2026-86131 advisory lists fixes across supported Fireware OS branches. Recent attacks against Cisco firewall management infrastructure have separately shown how compromised security systems can expose credentials, configurations, and paths into internal networks.
Malicious VPN servers can reach Firebox root
CVE-2026-86131 affects how Fireware OS processes BOVPN over TLS client configurations. WatchGuard associates the flaw with code injection, improper certificate validation, and functionality from an untrusted control sphere.
The vulnerability is not a general unauthenticated flaw that attackers can exploit simply by sending traffic directly to an internet-facing Firebox. The appliance must establish the affected BOVPN over TLS client connection to a server under the attacker's control.
For standard Fireware OS deployments, WatchGuard lists affected ranges as 2026.3 to before 2026.3.2, 2025.0 to before 2026.2.3, and 12.0 to before 12.12.3. T15 and T35 devices are affected from 12.0 to before 12.5.21.
Fixed versions are Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 for T15 and T35 devices.
Patching closes the documented attack path
WatchGuard lists upgrading as the solution and provides no separate workaround for CVE-2026-86131. Configuration hardening and monitoring can reduce exposure or help identify suspicious activity, but they do not replace the fixed releases.
Organizations should:
- Upgrade affected Firebox appliances. Install the applicable fixed Fireware OS release for each device and branch.
- Disable unnecessary BOVPN over TLS client connections. Remove configurations that are no longer operationally required.
- Verify configured VPN peers. Confirm that primary and backup server destinations are authorized and expected.
- Restrict unnecessary tunnel routes. Limit traffic to required networks or hosts as a defense-in-depth measure.
- Monitor for suspicious activity. Investigate unexpected VPN destinations, configuration or administrative changes, and unusual outbound connections.
- Test incident response plans for firewall compromise. Confirm procedures for isolation, evidence preservation, credential rotation, recovery, and restoration of network services.
CVE-2026-86131 is one of 15 Fireware OS vulnerabilities addressed in the release. A SecurityWeek review of the update identified 13 additional high-severity flaws and one medium-severity issue involving risks such as remote code execution, authorization bypass, unauthorized SSL VPN access, file reads, and denial of service.
Recent attacks have also targeted other security appliances with privileged access to enterprise networks. September incidents included an actively exploited Cisco Secure Email Gateway vulnerability and a Check Point security management zero-day, although neither is related to CVE-2026-86131.
WatchGuard still reports no known exploitation of CVE-2026-86131 as of Oct. 1. With fixed releases available, affected organizations can close the documented attack path before exploitation is observed.
Also read: For another recent network-edge vulnerability, see how a critical Cisco Nexus 9000 flaw could allow unauthenticated attackers to execute code as root on affected switches.