Loading story…
WatchGuard disclosed three vulnerabilities affecting WatchGuard AP firmware versions 1.0 through 3.4.7, including two critical unauthenticated flaws: CVE-2026-86102 and CVE-2026-101891. Both carry a CVSS v4 score of 9.3 and can allow a network-based attacker to bypass authentication or execute arbitrary operating-system commands through exposed internal API functionality. A third issue, CVE-2026-87969 (CVSS 8.6), enables authenticated administrators to inject and execute OS commands through crafted diagnostic command-line input.
WatchGuard fixed all three vulnerabilities in firmware version 3.4.8. The company reported no known in-the-wild exploitation or public proof of concept at disclosure, but the unauthenticated network-reachable attack paths make unpatched APs high-risk. Organizations should immediately upgrade affected devices, restrict AP management and API interfaces to trusted administrative networks, and review logs and administrator credentials for signs of unauthorized access.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
WatchGuard disclosed CVE-2026-86102 and CVE-2026-101891, critical unauthenticated internal-API flaws that permit command execution or access-control bypass, plus CVE-2026-87969, an authenticated diagnostic CLI command-injection flaw. The issues affect AP firmware versions 1.0 through 3.4.7 and were fixed in firmware version 3.4.8; no active exploitation was publicly known at disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecybersecuritynews.com
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard released fixes for five **critical** vulnerabilities in Fireware OS and WatchGuard Dimension, all rated CVSS v4 9.3. Three flaws in the internet-exposed `iked` IKE/VPN daemon—including the pre-authentication stack buffer overflow tracked as `CVE-2026-19318`—could allow unauthenticated attackers to execute code by sending crafted VPN traffic, creating a direct perimeter-compromise risk. A fourth Fireware issue affects the deprecated Mobile Security `epm` service, while a WatchGuard Dimension vulnerability could let a low-privileged administrator hijack a Super Administrator session. WatchGuard reported no confirmed exploitation or public proof-of-concept code, but organizations should apply the available updates immediately; where patching is delayed, VPN and management interfaces should be limited to trusted networks.
Sep 1, 2026
WatchGuard patched two critical vulnerabilities in its Windows WatchGuard Agent that allow unauthenticated remote code execution: `CVE-2026-57909` (CVSSv4 9.4) and `CVE-2026-57910` (CVSSv4 9.3). `CVE-2026-57909` is a path-traversal flaw exploitable by an attacker on an adjacent network, while `CVE-2026-57910` stems from improper authentication in the agent's UDP discovery and command service. An attacker exploiting `CVE-2026-57910` can invoke the `TaskExecute` handler to make an affected agent download and run an attacker-controlled program with elevated, potentially `SYSTEM`, privileges. All Windows Agent releases before version `1.25.13.0000` are affected; organizations should upgrade to `1.25.13.0000` or later. WatchGuard reported no known active exploitation or public proof-of-concept at disclosure.
Aug 27, 2026
WatchGuard published security advisories for multiple **Fireware OS** vulnerabilities affecting **Firebox** appliances and related deployments, and the Canadian Centre for Cyber Security urged organizations to apply updates. The issues include an **out-of-bounds write** that could allow a privileged, authenticated administrator to achieve **root-level arbitrary code execution** via an exposed management interface (**CVE-2026-3342**), and a **filesystem integrity check bypass** that could allow an attacker to maintain **limited persistence** by using a maliciously crafted firmware update package (**CVE-2026-3344**). A separate advisory also notes a **reflected XSS** issue in the Fireware Web UI (**CVE-2026-3343**). Affected versions span multiple Fireware OS branches, including **12.0–12.11.7**, **12.5.9–12.5.16** (T15/T35 models), and **2025.1–2026.1.1**, with additional impact noted for **11.x** in the out-of-bounds write advisory (11.x is end-of-life). WatchGuard’s fixes are available in **12.11.8**, **12.5.17**, and **2026.1.2** (depending on branch/model), and no workaround was listed for the integrity-check bypass or out-of-bounds write issues; organizations should prioritize patching and ensure management interfaces are not unnecessarily exposed.
Jul 3, 2026