Watchguard Ap
Monthly
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
OS command injection in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands on the affected access point by supplying crafted input to a diagnostic parameter. The vulnerability carries a CVSS v4.0 base score of 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and is independently assessed as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; exploitation requires valid administrator credentials for the AP's CLI (PR:H), but once authenticated no user interaction and only low attack complexity are needed, yielding high confidentiality, integrity, and availability impact on the device itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so realistic risk is concentrated where the AP management/CLI is network-reachable and administrative credentials are weak, reused, or exposed.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
OS command injection in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands on the affected access point by supplying crafted input to a diagnostic parameter. The vulnerability carries a CVSS v4.0 base score of 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and is independently assessed as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; exploitation requires valid administrator credentials for the AP's CLI (PR:H), but once authenticated no user interaction and only low attack complexity are needed, yielding high confidentiality, integrity, and availability impact on the device itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so realistic risk is concentrated where the AP management/CLI is network-reachable and administrative credentials are weak, reused, or exposed.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.