Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
To check whether a WatchGuard Firebox was vulnerable to the Fireware OS code injection flaw CVE-2026-86131, match its model and exact installed Fireware OS version to WatchGuard’s affected-version table. The fixed threshold differs by software branch, and T15/T35 appliances have a separate 12.x threshold. A version match means the software was vulnerable; it does not prove that the device was compromised.
Check the Firebox model and installed version
- Identify the model. Record the exact Firebox model, including whether it is a T15 or T35. WatchGuard lists those models separately from the default product group for the 12.x branch.
- Record the exact Fireware OS version and branch. Use the device’s management interface or your inventory records. The WatchGuard advisory does not specify a particular menu path for finding the version.
- Compare both details with the affected-version table. Use WatchGuard’s CVE-2026-86131 advisory as the authoritative record, and check it for updates before making a change.
- For a fleet, check every appliance separately. Do not apply one device’s threshold to another model or branch.
Which Fireware OS versions are affected?
In its PSIRT record published and updated September 29, 2026, WatchGuard lists these affected ranges and fixed thresholds:
As an Amazon Associate I earn from qualifying purchases.
| Device group and branch | Affected versions | Fixed from |
|---|---|---|
| Default product group, Fireware OS 2026.3 | 2026.3 before 2026.3.2 | 2026.3.2 |
| Default product group, Fireware OS 2025.0 | 2025.0 before 2026.2.3 | 2026.2.3 |
| Default product group, Fireware OS 12.x | 12.0 before 12.12.3 | 12.12.3 |
| T15/T35, Fireware OS 12.x | 12.0 before 12.5.21 | 12.5.21 |
For example, a default-group appliance on Fireware OS 12.12.2 falls within the listed affected range; a T15 or T35 on 12.12.2 must instead be assessed against its separate 12.x row. The table’s thresholds apply to the corresponding product group and branch, not to all Fireboxes interchangeably.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
What an affected version does—and does not—tell you
WatchGuard describes CVE-2026-86131 as a code injection flaw in Fireware OS BOVPN Over TLS client configuration handling. The stated attack condition is that an attacker controls the remote VPN server; the possible impact is arbitrary command execution as root on a connecting Firebox. WatchGuard rates it Critical, with a CVSS v4.0 score of 9.2, and maps it to CWE-94, improper control of code generation (code injection).
#1 Best Overall
WatchGuard Firebox T125 with 1 Year Standard Support - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250061)
- Watchguard T125 Firebox with 1 Year Standard Support License (WGT125001) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
If a device ran a version in the affected range, it ran software WatchGuard lists as vulnerable. That alone does not establish that an attacker controlled its VPN server, that it connected to a malicious server, or that commands were executed. WatchGuard stated in its September 29, 2026 advisory that it was “not aware of any exploitation of this vulnerability in the wild.” That reports the vendor’s awareness as of that date; it is not a device-specific finding or a guarantee about later events.
Quick Recap
Best Value
WatchGuard Firebox T125 with 1 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250071)
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #4
WatchGuard Firebox T125 with 3 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250073)
- Watchguard T125 Firebox with 3 Year Basic Security Suite License (WGT125033) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #3
WatchGuard Firebox T145 with 1 Year Basic Security Suite - Tabletop Firewall, 2.5Gb, 1Gb & SFP Ports, Enterprise Security for Branch Locations (WGT145000+WGT1450071)
- Watchguard T145 Firebox with 1 Year Basic Security Suite License (WGT145031) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
Rank #2
WatchGuard Firebox T125-W with 1 Year Standard Support - Wi-Fi 7 Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Remote Offices (WGT126000+WGT1260061)
- Watchguard T125-W Firebox with 1 Year Standard Support License (WGT126001) - The T125-W adds Wi-Fi 7 capability to the powerful Firebox T125 platform. Designed for branch or remote offices, it delivers 510 Mbps UTM throughput, advanced security services, and full wireless coverage in a single, compact appliance.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: Wi-Fi 7 plus 1x 2.5Gb and 4x 1Gb Ethernet for coverage, clean uplinks, and straightforward VLAN segmentation with Cloud visibility.
- Performance and scale: UTM up to 510 Mbps with inspection on; add sites confidently with scalable VPN.
What to do if the version is affected
- Plan an upgrade to the applicable fixed release or a later suitable release. The threshold depends on the appliance’s model group and Fireware branch.
- Check compatibility and upgrade sequencing. Confirm the supported path in WatchGuard’s current product documentation before upgrading a production device.
- Keep the assessment distinct from an incident investigation. If you need to determine historical exposure or possible compromise, preserve firmware and configuration history and use a qualified incident-response process. The advisory provides version ranges, not device-level forensic indicators or a serial-number lookup.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
