Two WatchGuard Wireless Flaws Need No Login
WatchGuard’s 28 September 2026 notices cover three access-point flaws in firmware from 1.0 to before 3.4.8. The vendor knew of no exploitation at publication.
Different prerequisites
| Record | Prerequisite | Rating |
|---|---|---|
| CVE-2026-101891 | A reachable internal programming interface grants a session without credentials because permission checks are inadequate. | Critical, 9.3 |
| CVE-2026-86102 | A reachable internal programming interface for management accepts injected system-level commands without credentials or user interaction. | Critical, 9.3 |
| CVE-2026-87969 | An administrator can run arbitrary system instructions through the diagnostic command-line interface. | High, 8.6 |
No mandatory API chain is established. Ratings use CVSS 4.0. Inspect wired, wireless and management paths; universal internet or wireless-client exposure is not established.
A release announcement does not prove installation
The cloud-managed build is v3.4.8-1.B747709, dated 24 September, with strengthened command-line and API access. Confirm the installed firmware on each device against the fixed release, rather than treating availability as evidence that deployment finished.
The upgrade guide describes a default seven-day delay, staggered installations and maintenance windows. Offline devices can miss the first window. Check actual device status and pending schedules; these configurable delays do not prove that any particular customer’s devices remain vulnerable. Upgrades reboot devices and temporarily interrupt connected clients.
BlackTree operational analysis: Start with representative locations. Before proceeding to the next group, verify management reconnection, expected SSIDs, normal client authentication and VLAN traffic. This service test is our rollout advice, not an extra vendor patch prerequisite.
Finish the repair
Where feasible, restrict management paths from guest, user and other untrusted networks; review diagnostic administrators. Segmentation and account hygiene are safeguards, not universal vendor workarounds or patch substitutes.
For a cloud-managed unit unable to retrieve an update, the local installation guide documents a manual browser route. Check the hardware model, release identity and download checksum first; a file for another hardware family is not a shortcut.
Campaign, indicators and estate size remain unknown. That proves neither attacks nor their absence. Investigate independent warnings and retain device/network records.
This is not the firmware line discussed in our earlier Firebox VPN report. Fireware OS and the access-point line need separate patch decisions. For these wireless devices, verify installation, management reachability and the staged service test.
Sources
Rechecked 21 October 2026:
- The individual session-access, management-command and administrator-command advisories.
- Firmware release history.
- Upgrade guide and local installation guide.
