External risk intelligence

WatchGuard Fireware BOVPN Code Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-86131

The vulnerability exists in WatchGuard Fireware OS, which is a network security appliance (firewall/VPN gateway). These devices are commonly deployed at the network edge, and the vulnerable component involves BOVPN (Branch Office VPN) client configuration, which is a standard, externally facing remote connectivity function of the product.

Code Injection

Watchguard Fireware

12.0 to before 12.5.2112.12 to before 12.12.32025.0 to before 2026.2.32026.3 to before 2026.3.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in WatchGuard Fireware OS related to how it handles specific VPN configurations. This issue could allow an attacker who controls a remote VPN server to execute commands on your connected Firebox devices, potentially impacting network security. The primary concern is to confirm if your network is exposed and what systems may be affected.

Code injection flaw in VPN configuration.
Network security devices are at risk.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker who controls a remote VPN server can send specially crafted configurations to a WatchGuard Firebox. This allows the attacker to trick the Firebox into executing arbitrary commands with root privileges on the device.

External VPN server access is required.
The vulnerability is triggered by BOVPN client configuration handling.
Allows remote code execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker who controls a remote VPN server to execute arbitrary commands as the root user on a connected Firebox appliance. This occurs when the Firebox is configured to use its BOVPN Over TLS client functionality.

Affected: Firebox appliances processing BOVPN Over TLS.
Exposure: Malicious VPN server.
Consequence: Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Network and security teams are primarily responsible for addressing this vulnerability in WatchGuard Fireware OS, as it affects network edge devices critical for secure remote access. The immediate first step is to identify all Firebox devices running the affected Fireware OS versions, determine their exposure to the internet, and confirm their business criticality to prioritize remediation efforts. Coordination with the vendor for patches or mitigation guidance is essential.

Network/security teams own the issue.
Verify external-facing BOVPN configurations.
Plan vendor-coordinated updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WatchGuard Fireware OS and what does it do?

WatchGuard Fireware OS is the operating system that powers Firebox appliances, which are security devices used to protect corporate networks. It provides critical features like firewalling and secure remote access through VPN tunnels. These devices act as gateways that connect office sites or remote workers to the internal network, ensuring traffic is inspected and managed.

What is the vulnerability in CVE-2026-86131?

This vulnerability is a code injection issue, categorized under CWE-94. In plain English, it means the system incorrectly handles data received during the configuration of a VPN connection. By sending malicious commands disguised as configuration settings, an attacker can trick the appliance into running those commands with full root-level administrative control.

How is this BOVPN code injection triggered?

The flaw is triggered specifically when a Firebox acts as a client for a BOVPN Over TLS connection. An attacker must successfully control the remote VPN server that the Firebox is attempting to connect to. Importantly, simply having a VPN configured does not trigger the bug; the device must actively process a malicious configuration response from the server it is connecting to.

Is my device relevant according to Halo Surface Signal?

Yes, if you use WatchGuard Firebox appliances, they are likely relevant to this threat. Halo Surface Signal classifies this as an external risk because these devices function as network edge gateways. Since the vulnerable component handles remote connectivity, any Firebox that establishes BOVPN Over TLS links is considered part of the potential attack surface.

What should I do first to address CVE-2026-86131?

Start by auditing your infrastructure to list all Firebox devices running the affected versions of Fireware OS. Once identified, check if those units are configured to use the BOVPN Over TLS client functionality. Prioritize devices that support critical remote access and check the vendor's official portal for the latest firmware updates or specific mitigation instructions.

References

psirt.watchguard.com/CVE-2026-86131

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.