CVE-2026-86131 affects WatchGuard Fireware OS, the operating system of Firebox firewalls. Published by NVD on September 30, 2026, rated 9.8. It concerns one specific feature: the client configuration of BOVPN over TLS, the site-to-site tunnel wrapped in TLS.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD published | 2026-09-30 |
| CISA KEV | no (as of writing) |
What the Flaw Does
allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
The direction of the attack is unusual. This isn't a client attacking the firewall: it's the remote VPN server that the Firebox connects to as a client. If that server is malicious or compromised, it can get commands executed as root on the connecting Firebox, through code injection in the client configuration handling.
Why it matters despite the precondition:
- Trust is transitive. A BOVPN tunnel often links your site to a partner, a subsidiary, a provider or a less-protected remote site. Compromising the weakest end hands over the other.
- Root on a firewall means control of traffic, rules, tunnels and the VPN secrets stored on the device.
- The Firebox doesn't distrust what comes back from a peer it was configured to treat as legitimate.
If none of your Fireboxes is configured as a BOVPN over TLS client, this attack path doesn't apply to you. Upgrade anyway: configurations change.
Versions
NVD lists the following bounds for Fireware OS:
| Branch | NVD bound |
|---|---|
| 12.5 | 12.5.21 |
| 12.12 | 12.12.3 |
| 2026.2 | 2026.2.3 |
| 2026.3 | 2026.3.2 |
These are NVD bounds, not necessarily the fixed releases. WatchGuard's PSIRT advisory gives the version to install for each branch.
Am I Affected?
- List BOVPN over TLS tunnels on every Firebox, and flag those acting as client.
- Identify who operates the remote server: you, another entity in your group, a third party?
- Assess how trustworthy that server really is — patched, monitored, administered by whom?
Detection
- Firebox logs: unplanned reboots, configuration or account changes, especially right after a BOVPN over TLS tunnel comes up
- Firewall rules or tunnels added with no documented change — compare against your last configuration backup
- Unusual outbound traffic from the Firebox management address
- On the remote server side: any sign of compromise should trigger a review of the Fireboxes connecting to it
Mitigation
- Upgrade Fireware OS to the fixed release WatchGuard specifies for your branch.
- Meanwhile, disable client-mode BOVPN over TLS tunnels to servers you don't control, or move them to another tunnel type if WatchGuard's advisory recommends it.
- Restrict the Firebox management interface to admin networks.
- Check configuration integrity on each client Firebox against an earlier backup.
- If in doubt: rotate the Firebox's VPN keys and secrets and admin credentials, and follow the vendor advisory's guidance.
Why Continuous Firewall Monitoring Matters
A firewall is supposed to be the boundary. When a 9.8 CVE lets a VPN peer take it over as root, the question is no longer only what's exposed to the internet, but who you trust at the other end of the tunnel.
With cveo.tech, inventory your firewalls with exact versions, and get alerted whenever a critical CVE affects them.