EUVD-2026-89497
GHSA-hrq5-fh6w-qjmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the requirement that the Firebox connect to an attacker-controlled VPN server (AT:P equivalent); PR:N/UI:N as no Firebox auth or user action is needed; C/I/A:H for root code execution, S:U as impact stays on the device.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
AnalysisAI
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, allowing whoever controls the remote TLS VPN peer to push malicious configuration data that the connecting Firebox executes with root privileges, compromising the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 9.2, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is conditional rather than blanket internet-facing: the Firebox must be configured as a BOVPN Over TLS client and must actively initiate a session to an attacker-operated or attacker-compromised server, so a successful attack implies a malicious or hijacked peer relationship rather than an opportunistic scan-and-exploit against any Firebox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Firebox to be configured as a BOVPN Over TLS client and to initiate a TLS VPN session to a server the attacker controls (either attacker-operated or a compromised legitimate peer). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-severity, credible priority rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-86131 and apply the fixed Fireware OS build WatchGuard designates for the affected versions; the reference data provided does not include an exact fix version, so the precise patched firmware number must be taken from that advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WatchGuard Fireware OS appliances and identify every Firebox configured as a BOVPN Over TLS client; if BOVPN Over TLS client functionality is not business-critical, disable it immediately, and if it is required, restrict configured peer endpoints to trusted static IP addresses and enforce strict certificate validation so the Firebox cannot initiate sessions to unknown or attacker-controlled servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today