{"api_version":"1","generated_at":"2026-10-01T19:23:18+00:00","cve":"CVE-2026-86131","urls":{"html":"https://cve.report/CVE-2026-86131","api":"https://cve.report/api/cve/CVE-2026-86131.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-86131","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-86131"},"summary":{"title":"Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution","description":"A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.","state":"PUBLISHED","assigner":"WatchGuard","published_at":"2026-09-30 00:16:36","updated_at":"2026-10-01 18:17:28"},"problem_types":["CWE-94","CWE-295","CWE-829","CWE-295 CWE-295","CWE-829 CWE-829","CWE-94 CWE-94"],"metrics":[{"version":"4.0","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86131","name":"https://psirt.watchguard.com/CVE-2026-86131","refsource":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86131","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86131","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 2026.3 2026.3.2 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 2025.0 2026.2.3 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 12.0 12.12.3 custom","platforms":["Default"]},{"source":"CNA","vendor":"WatchGuard","product":"Fireware OS","version":"affected 12.0 12.5.21 custom","platforms":["T15/T35"]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21","time":"","lang":"en"}],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild.","time":"","lang":"en"}],"credits":[{"source":"CNA","value":"btaol","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-86131","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-01T03:55:39.882228Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-01T17:08:46.734Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Default"],"product":"Fireware OS","vendor":"WatchGuard","versions":[{"lessThan":"2026.3.2","status":"affected","version":"2026.3","versionType":"custom"},{"lessThan":"2026.2.3","status":"affected","version":"2025.0","versionType":"custom"},{"lessThan":"12.12.3","status":"affected","version":"12.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["T15/T35"],"product":"Fireware OS","vendor":"WatchGuard","versions":[{"lessThan":"12.5.21","status":"affected","version":"12.0","versionType":"custom"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination.</p>"}],"value":"This vulnerability affects Firebox systems configured with a BOVPN Over TLS connection to an attacker-controlled destination."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"12.5.21","versionStartIncluding":"12.0","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.3.2","versionStartIncluding":"2026.3","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.3","versionStartIncluding":"2025.0","vulnerable":true},{"criteria":"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*","versionEndExcluding":"12.12.3","versionStartIncluding":"12.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"btaol"}],"descriptions":[{"lang":"en","value":"A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild."}],"value":"WatchGuard is not aware of any exploitation of this vulnerability in the wild."}],"metrics":[{"cvssV4_0":{"baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"CWE-295","lang":"en","type":"CWE"},{"cweId":"CWE-829","description":"CWE-829","lang":"en","type":"CWE"},{"cweId":"CWE-94","description":"CWE-94","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-29T23:05:47.700Z","orgId":"5d1c2695-1a31-4499-88ae-e847036fd7e3","shortName":"WatchGuard"},"references":[{"tags":["vendor-advisory"],"url":"https://psirt.watchguard.com/CVE-2026-86131"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"}],"value":"Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"}],"title":"Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution"}},"cveMetadata":{"assignerOrgId":"5d1c2695-1a31-4499-88ae-e847036fd7e3","assignerShortName":"WatchGuard","cveId":"CVE-2026-86131","datePublished":"2026-09-29T23:05:47.700Z","dateReserved":"2026-09-05T02:50:33.788Z","dateUpdated":"2026-10-01T17:08:46.734Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-30 00:16:36","lastModifiedDate":"2026-10-01 18:17:28","problem_types":["CWE-94","CWE-295","CWE-829","CWE-295 CWE-295","CWE-829 CWE-829","CWE-94 CWE-94"],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T03:55:39.882228Z","id":"CVE-2026-86131","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"86131","Ordinal":"1","Title":"Fireware OS Code Injection in BOVPN Over TLS Client Allows Remot","CVE":"CVE-2026-86131","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"86131","Ordinal":"1","NoteData":"A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.","Type":"Description","Title":"Fireware OS Code Injection in BOVPN Over TLS Client Allows Remot"}]}}}