WatchGuard released fixes for 15 vulnerabilities in Fireware OS, including CVE-2026-86131, a critical RCE flaw that could let a remote attacker controlling a VPN server execute commands as root on a Firebox appliance. The update also addresses multiple high-severity issues and recent Access Point flaws in WatchGuard AP, with no known...

TL;DR WatchGuard disclosed 14 Fireware OS vulnerabilities on September 29, 2026, affecting its Firebox firewalls. The worst, CVE-2026-86131, scores CVSS 9.2 and allows remote code execution in certain VPN setups. Fixed releases include Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Why These Fireware OS Vulnerabilities Matter Firebox appliances guard the network edge and terminate VPN connections for many businesses. Edge devices are a favorite target, because a single foothold can open the whole network.

The WatchGuard Fireware operating system's iked component can be tricked by specially formatted network messages to run any code an attacker wants.

The core software that controls WatchGuard firewalls can be tricked by specially crafted network traffic, allowing an outsider to run their own programs.

The iked component of WatchGuard Fireware OS can be tricked by specially crafted network traffic, allowing an external attacker to run any code on the.

The outdated Mobile Security component in WatchGuard Fireware OS contains a flaw that lets anyone on the network send specially crafted data to the.

A vulnerability in WatchGuard Firebox's Mobile User VPN with IKEv2 allows an attacker to run unauthorized code on affected devices.

TL;DR WatchGuard has patched seven WatchGuard Firebox vulnerabilities in its Fireware OS. The worst, CVE-2026-13368 (CVSS 9.2), lets a remote unauthenticated attacker run code on affected appliances. WatchGuard reports no exploitation in the wild, and no public proof-of-concept exists. Why It Matters Firebox appliances guard the network edge for many small and mid-sized firms. Therefore, a pre-auth flaw on this device exposes the whole perimeter.