CriticalCritical vulnerability
CVE-2026-86131 (CVSS 9.2)
NVD · officialPublished Sep 30, 2026Risk 50/100
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Technical details
CVSS
9.2
AV:NetworkAC:LowPR:NoneUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source