Quick answers
- Is CVE-2026-86131 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86131 being exploited in the wild.
- How severe is CVE-2026-86131?
- Informational severity, published 30 September 2026.
- Which products and versions are affected?
- Watchguard Fireware OS Default: >=12.0 <12.12.3, >=2025.0 <2026.2.3, >=2026.3 <2026.3.2; T15/T35: >=12.0 <12.5.21.
- Is there a fix for CVE-2026-86131?
- A patch was published on 2026-09-29: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86131 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-86131?
- Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from improper code generation in BOVPN over TLS client configuration handling (CWE-94) combined with insufficient certificate validation (CWE-295), enabling code injection. An attacker who controls or can intercept the remote VPN server connection can inject malicious code that executes as root. The vulnerability affects Fireware OS versions prior to 2026.3.2, 2026.2.3, and 12.12.3 depending on the product line, and patched versions are available.
Affected products
- WatchGuard Fireware OS Default: >=12.0 <12.12.3, >=2025.0 <2026.2.3, >=2026.3 <2026.3.2; T15/T35: >=12.0 <12.5.21
Timeline
- 2026-09-29: disclosed
- 2026-09-29: patched: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21