The VPN Server Your Firebox Trusts Could Hand It Root Commands
WatchGuard has patched 15 vulnerabilities across supported Fireware OS branches. The most serious one turns an expected trust relationship inside out: a hostile remote VPN server can send configuration that a connecting Firebox executes as root.
That is not an unrestricted internet takeover. An attacker must control the remote server used by a Firebox configured as a BOVPN over TLS client. But for organisations that use that topology, CVE-2026-86131 crosses one of the hardest security boundaries on the device.
WatchGuard fixed the issue in Fireware OS 2026.3.2, 2026.2.3 and 12.12.3. T15 and T35 appliances on the older branch need 12.5.21. The company says it is not aware of exploitation.
The same release closes 14 other flaws. They include adjacent-network code execution through DHCP fingerprinting, remote crashes in IKEv2 and NetFlow processing, local file disclosure through low-privilege management accounts, and access-control failures involving the Access Portal.
The topology condition should shape triage. Organisations that do not use a Firebox as a BOVPN over TLS client do not share the lead flaw’s direct exposure, while those that do should treat the remote server as part of the firewall’s privileged trust boundary. That means ownership, certificates, configuration history and administrative access to the server belong in the same review as the appliance patch.
Fifteen flaws, five remediation paths
WatchGuard’s advisories do not use one universal version matrix. Most appliances follow three current release branches, while T15 and T35 models usually require a separate 12.5.21 build. One SAML flaw also has an EUCC-specific fix, and the DHCP flaw does not list the T15/T35 branch.
Update, 31 October 2026: The rows below include the vendor’s current interface and feature prerequisites. The listed versions are the bulletin’s fixed baselines, not a statement that each is the newest available build. Check the supported-model and upgrade requirements in the linked release notes.
CVE-2026-86134, CVSS 8.7
Exposure and impact: No authentication. A crafted login request can crash the management daemon.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-86104, CVSS 8.7
Exposure and impact: No authentication, but access to an authentication interface such as the management Web UI or Access Portal is required. A crafted request can exhaust resources in wgagent and cause denial of service.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-18145, CVSS 8.6
Exposure and impact: An authenticated administrator can send a crafted management request that crashes spamd or potentially executes code.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-13046, CVSS 7.5
Exposure and impact: The attacker needs network access to an authentication interface such as the Access Portal and must already be able to write arbitrary files on the appliance. A malicious SAML session file can then execute code in samld.
Affected and fixed versions: Common branches are fixed in 2026.3.2, 2026.2.3 and 12.12.3. EUCC 12.11 is affected before 12.11.10. WatchGuard’s product table marks 2026.3.2 as not affected, although its Solution field lists only 2026.2.3, 12.12.3 and 12.11.10.
CVE-2026-86101, CVSS 7.2
Exposure and impact: An authenticated SAML user limited to the Access Portal can gain unauthorised Mobile VPN with SSL access.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-86133, CVSS 8.2
Exposure and impact: A remote attacker must complete the initial IKEv2 handshake. On a branch-office IKEv2 VPN to a dynamic peer, or mobile IKEv2 VPN, a crafted encrypted message can then crash iked.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-13224, CVSS 8.2
Exposure and impact: An authenticated administrator with network access to the Management Web UI can use path traversal in the WebUI management agent to read or list arbitrary local files.
Affected and fixed versions: Current branches are fixed in 2026.3.2, 2026.2.3 and 12.12.3. The all-platform 12.0 line is affected before 12.5.21 and fixed in 12.5.21.
CVE-2026-86132, CVSS 8.2
Exposure and impact: No authentication. On a branch-office IKEv2 VPN to a dynamic peer, or mobile IKEv2 VPN, a crafted encrypted IKEv2 message negotiated with AES-GCM can crash iked.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-86105, CVSS 5.3
Exposure and impact: An authenticated low-privilege Access Portal user can reach unauthorised web applications when the Access Portal has multiple reverse-proxy resources.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-90441, CVSS 7.1
Exposure and impact: An authenticated read-only or guest administrator with network access to a management interface can crash wgagent and read files available to the daemon through a crafted API request.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-86131, CVSS 9.2
Exposure and impact: The attacker must control the remote VPN server used by a BOVPN over TLS client. Malicious configuration can run commands as root on the connecting Firebox.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-86136, CVSS 7.1
Exposure and impact: An authenticated read-only or guest administrator with network access to a management interface can crash wgagent and read files available to it through a crafted API request.
Affected and fixed versions: 2026.0 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-81433, CVSS 8.7
Exposure and impact: No authentication, but adjacent-network access is required. A crafted DHCP packet can crash the fingerprinting daemon or execute code.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3. Fixes: 2026.3.2, 2026.2.3 and 12.12.3. No T15/T35 row is listed.
CVE-2026-86128, CVSS 8.2
Exposure and impact: No authentication. Where NetFlow is enabled on an IPv6 path, a crafted IPv6 packet can crash NetFlow packet processing.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
CVE-2026-18105, CVSS 7.1
Exposure and impact: An authenticated low-privilege user with network access to the Management Web UI can repeatedly start and abort a crafted diagnostic task, disrupting diagnostic tools.
Affected and fixed versions: 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3; T15/T35 12.0 to before 12.5.21. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
As of 31 October, the current vendor advisories state that WatchGuard is not aware of exploitation of any of these 15 vulnerabilities. That is a vendor statement, not a complete view of attacks or an investigation of a particular appliance. It does not justify delaying the appropriate update.
What administrators should do now
First, inventory each Firebox by model, exact running version and role. Do not apply the headline version to every device without checking the correct branch. The fixed releases are:
- Fireware OS 2026.3.2 for the 2026.3 branch.
- Fireware OS 2026.2.3 for the 2025.0 through 2026.2 branch.
- Fireware OS 12.12.3 for the general 12.x branch.
- Fireware OS 12.5.21 for affected T15 and T35 appliances.
- Fireware OS 12.11.10 for affected EUCC systems covered by the SAML session-file advisory.
After upgrading, confirm the running version after reboot rather than relying only on a completed update job. In high-availability pairs, verify both members and check that traffic has returned to the intended active appliance.
Organisations using BOVPN over TLS should identify every Firebox operating as a client, confirm who controls the remote server and compare its identity and configuration with the expected deployment record. Unexpected server changes, newly introduced configuration, unexplained root-level activity or unplanned tunnel changes deserve investigation.
Reduce exposure while patching. Limit management and Access Portal reachability to the networks and users that need it. Review read-only, guest and low-privilege accounts rather than assuming they cannot affect availability or retrieve sensitive files. On local networks, treat unexpected DHCP activity and repeated fingerprinting-daemon failures as signals worth investigating.
Operational logs should also be checked for unusual wgagent, iked, spamd, samld or NetFlow crashes. Those events are not proof of exploitation by themselves, but they can help identify appliances that need closer review.
Separate this Fireware release from the older incidents
BlackTree previously covered three different Firebox vulnerabilities that could turn a VPN handshake into remote code execution and an older Firebox flaw later linked to ransomware. Most advisories in this separate 15-flaw set were published on 29 September UTC. The official record for the management-login crash was published at 05:37 CEST on 30 September. It needs its own remediation decision.
The central lesson is not that every Firebox is open to anyone on the internet. It is that infrastructure can be compromised through the systems it has been configured to trust. Patching closes the known code paths. Verifying those trusted relationships is what addresses the larger failure mode.
