CVE-2026-86131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86131", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-09-05T02:50:33.788Z", "datePublished": "2026-09-29T23:05:47.700Z", "dateUpdated": "2026-10-01T17:08:46.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-29T23:05:47.700Z"}, "title": "Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution", "descriptions": [{"lang": "en", "value": "A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox."}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2026.3", "versionType": "custom", "lessThan": "2026.3.2"}, {"status": "affected", "version": "2025.0", "versionType": "custom", "lessThan": "2026.2.3"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.12.3"}], "defaultStatus": "unaffected", "platforms": ["Default"]}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.5.21"}], "defaultStatus": "unaffected", "platforms": ["T15/T35"]}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-86131", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.5.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.3", "versionEndExcluding": "2026.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.0", "versionEndExcluding": "2026.2.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.12.3"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-295", "type": "CWE", "cweId": "CWE-295"}, {"lang": "en", "description": "CWE-829", "type": "CWE", "cweId": "CWE-829"}, {"lang": "en", "description": "CWE-94", "type": "CWE", "cweId": "CWE-94"}]}], "credits": [{"lang": "en", "value": "btaol", "type": "finder"}], "configurations": [{"lang": "en", "value": "This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination.</p>"}]}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T03:55:39.882228Z", "id": "CVE-2026-86131", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T17:08:46.734Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T03:55:39.882228Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T15:25:34.014Z"}}], "cna": {"title": "Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "btaol"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2026.3", "lessThan": "2026.3.2", "versionType": "custom"}, {"status": "affected", "version": "2025.0", "lessThan": "2026.2.3", "versionType": "custom"}, {"status": "affected", "version": "12.0", "lessThan": "12.12.3", "versionType": "custom"}], "platforms": ["Default"], "defaultStatus": "unaffected"}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "lessThan": "12.5.21", "versionType": "custom"}], "platforms": ["T15/T35"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "base64": false}]}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21", "supportingMedia": [{"type": "text/html", "value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21", "base64": false}]}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-86131", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295"}, {"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829"}, {"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94"}]}], "configurations": [{"lang": "en", "value": "This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination.", "supportingMedia": [{"type": "text/html", "value": "<p>This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination.</p>", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.5.21", "versionStartIncluding": "12.0"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.3.2", "versionStartIncluding": "2026.3"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.2.3", "versionStartIncluding": "2025.0"}, {"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.12.3", "versionStartIncluding": "12.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-29T23:05:47.700Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86131", "state": "PUBLISHED", "dateUpdated": "2026-10-01T17:08:46.734Z", "dateReserved": "2026-09-05T02:50:33.788Z", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "datePublished": "2026-09-29T23:05:47.700Z", "assignerShortName": "WatchGuard"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Default"], "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThan": "2026.3.2", "status": "affected", "version": "2026.3", "versionType": "custom"}, {"lessThan": "2026.2.3", "status": "affected", "version": "2025.0", "versionType": "custom"}, {"lessThan": "12.12.3", "status": "affected", "version": "12.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["T15/T35"], "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThan": "12.5.21", "status": "affected", "version": "12.0", "versionType": "custom"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C618D05C-B8A0-4912-B87E-B67A0686C14D", "versionEndExcluding": "12.5.21", "versionStartIncluding": "12.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "matchCriteriaId": "684B81A6-0CE5-4424-A38A-FE989C790E7F", "versionEndExcluding": "12.12.3", "versionStartIncluding": "12.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F11812A-FDA8-401D-871B-219DFDADEDC8", "versionEndExcluding": "2026.2.3", "versionStartIncluding": "2025.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "matchCriteriaId": "525833A2-ABEC-4C06-BE1B-6A5E64A21775", "versionEndExcluding": "2026.3.2", "versionStartIncluding": "2026.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox."}], "id": "CVE-2026-86131", "lastModified": "2026-10-06T20:39:54.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86131", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T03:55:39.882228Z", "version": "2.0.3"}}]}, "published": "2026-09-30T00:16:36.817", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "tags": ["Patch", "Vendor Advisory"], "url": "https://psirt.watchguard.com/CVE-2026-86131"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-829"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["default"], "status": "affected", "versions": {"scheme": "generic", "value": "[2026.3,2026.3.2)"}}, {"platform": ["default"], "status": "affected", "versions": {"scheme": "generic", "value": "[2025.0,2026.2.3)"}}, {"platform": ["default"], "status": "affected", "versions": {"scheme": "generic", "value": "[12.0,12.12.3)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Fireware OS", "source": "cna", "vendor": "WatchGuard"}, "product": "fireware_os", "vendor": "watchguard"}, {"configurations": [{"platform": ["t15/t35"], "status": "affected", "versions": {"scheme": "generic", "value": "[12.0,12.5.21)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Fireware OS", "source": "cna", "vendor": "WatchGuard"}, "product": "fireware_os", "vendor": "watchguard"}], "created": "2026-09-30T01:00:09.333190+00:00", "updated": "2026-09-30T08:15:17.423792+00:00", "vendors": ["watchguard", "watchguard$PRODUCT$fireware_os"]}