CVE-2026-86131 is a code injection flaw in the BOVPN over TLS client of WatchGuard Fireware OS (CVSS 9.8, critical). An attacker who controls the remote VPN server could run commands as root on the Firebox. Update to a fixed Fireware release. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
WatchGuard lists Fireware OS in these ranges: 2026.3 before 2026.3.2, 2025.0 before 2026.2.3, and 12.0 before 12.12.3. The T15 and T35 models are affected below 12.5.21. Fixed releases are 2026.3.2, 2026.2.3, 12.12.3 and, for T15 and T35, 12.5.21.
The weaknesses are CWE-295 and CWE-829 and CWE-94. WatchGuard says it is not aware of exploitation in the wild, and the record is not in the CISA KEV catalog. The attacker needs control of the remote VPN server the Firebox connects to, for example through impersonation.
How to check if you're exposed
Read the Fireware OS version in the Firebox web interface or from the command line.
show version
Then check whether you use BOVPN over TLS in client mode, which is the configuration the advisory names. Compare your version with the fixed releases for your model.
What to do now
- Update Fireware OS to 2026.3.2, 2026.2.3 or 12.12.3 as appropriate, or 12.5.21 on T15 and T35.
- Check whether any Firebox runs BOVPN over TLS as a client, and note the servers it connects to.
- Confirm the remote VPN server certificates are issued by a trusted authority you control.
- Review Firebox logs for VPN connections to unexpected servers.
- Subscribe to WatchGuard PSIRT notices.
Why it matters
The flaw has three parts. The client trusts configuration data from the server it connects to, may accept a server it should not trust, and then uses that data in a way that can run code. Certificate checks and input handling both matter.
VPN appliances sit at the network edge with high privilege, so a flaw in them deserves a fast update even when the attacker needs a special position.
Quick check
Is this exploited?
WatchGuard says it is not aware of exploitation, and the record is not in the CISA KEV catalog.
Sources
Last reviewed: 19 October 2026.
