WatchGuard AP CVE-2026-87969

Exploitation requires authenticated access to the WatchGuard AP diagnostic CLI as an administrator (PR:H) - the attacker must already possess valid admin credentials for the access point. Once authenticated, no user interaction and only low attack complexity are needed: the attacker supplies crafted input (shell metacharacters) to a diagnostic CLI parameter that is passed to an OS shell without sanitization. The primary limiting factor is the administrative privilege prerequisite, which removes this from unauthenticated mass-exploitation scenarios; realistic risk concentrates where the AP management/CLI interface is network-reachable and admin credentials are weak, reused, or exposed.

This is a genuine but administratively-gated vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 (High), reflecting full compromise of the AP's confidentiality, integrity and availability with low complexity and no user interaction - but critically requires PR:H, meaning the attacker must already hold administrative credentials on the device. This single fact separates it from a critical drive-by RCE: the flaw is a post-authentication privilege-to-code-execution escalation, valuable for pivoting or persistence rather than initial mass compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or automated exploitation. The high-CVSS score is therefore driven by impact (turning admin access into OS command execution), not by ease of reaching the vulnerable surface. Real-world priority is moderate: patch in due course, prioritize where AP admin interfaces are broadly exposed or where admin credentials may be shared/weak, but this is not an emergency internet-facing exposure. The scoring is internally consistent - vector, description (authenticated administrator) and CWE-78 all agree - so no signals conflict.

An attacker who has obtained WatchGuard AP administrator credentials (via phishing, credential reuse, or an insider) logs into the diagnostic CLI and submits a crafted parameter containing shell metacharacters, causing the AP to execute attacker-supplied OS commands with the CLI's privileges. This yields code execution on the access point for persistence, traffic interception, or lateral movement into the managed network. No public exploit code is identified at the time of analysis, and exploitation is bounded by the requirement to first authenticate as an administrator.