WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
WatchGuard on Tuesday announced fixes for 15 vulnerabilities in Fireware OS, including a critical-severity remote code execution (RCE) bug.
Tracked as CVE-2026-86131 (CVSS score of 9.2), the flaw is described as a code injection issue in how the operating system handles BOVPN over TLS client configurations.
Successful exploitation could allow a remote attacker who controls the remote VPN server to execute commands with root privileges on the connecting Firebox appliance.
The security weakness was resolved in Fireware OS versions 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21.
The security updates also resolve 13 high-severity vulnerabilities that could lead to RCE, authorization bypass, denial-of-service (DoS), unauthorized SSLVPN access, and arbitrary local file reads.
A medium-severity improper authorization issue leading to unauthorized access to web applications was also addressed.
Advertisement. Scroll to continue reading.
Several of these security defects could be exploited by remote attackers without authentication.
The Fireware OS patches landed one day after...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
