WatchGuard has patched CVE-2026-86131, a critical code-injection flaw in Fireware OS that could let an attacker controlling a remote BOVPN Over TLS server run commands as root on a connecting Firebox. Install the fixed release for your appliance’s Fireware branch: 2026.3.2, 2026.2.3, 12.12.3, or, for T15/T35 devices, 12.5.21.
What is CVE-2026-86131?
WatchGuard published the vulnerability on September 29, 2026, assigning it CVSS v4.0 severity 9.2, Critical. The flaw affects configuration handling in the Fireware OS BOVPN Over TLS client. An attacker must control the remote VPN server; if the vulnerable Firebox connects to it, the attacker could inject commands that execute with root privileges on the appliance.
WatchGuard describes the issue as a code-injection vulnerability that allows an attacker who controls the remote server to execute arbitrary commands as root on the connecting Firebox. The requirement to control that server is a meaningful condition, but root-level execution makes the flaw serious for any device that is both on an affected release and exposed to that trust relationship.
Which Fireware versions are affected?
Use the platform branch as well as the version number to identify the applicable fix. WatchGuard’s advisory lists these affected ranges and fixed releases:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- Watchguard T125 Firebox with 1 Year Standard Support License (WGT125001) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
| Platform branch | Affected versions | Fixed version |
|---|---|---|
| Default | 2026.3 through versions before 2026.3.2 | 2026.3.2 |
| Default | 2025.0 through versions before 2026.2.3 | 2026.2.3 |
| Default | 12.0 through versions before 12.12.3 | 12.12.3 |
| T15/T35 | 12.0 through versions before 12.5.21 | 12.5.21 |
The ranges and fixes are from WatchGuard’s security advisory and are also recorded by CVE.org. For a T15 or T35, use the separate 12.5.21 fixed line rather than assuming one of the default-branch releases applies.
What should Firebox administrators do?
- Inventory Fireboxes: identify each appliance’s model and currently installed Fireware branch, including any T15 or T35 units.
- Match the branch to its fix: upgrade to 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 as applicable to that appliance.
- Verify after reboot: confirm the running Fireware version on each device and record the model and branch so the fix can be tracked.
- Review the VPN trust path: check which remote servers are configured as BOVPN Over TLS peers and whether those servers are trusted and under appropriate control.
- Review monitoring: look for unexpected VPN-server behavior or commands around the disclosure period. The cited public sources do not provide a specific exploit or a complete indicator set for this CVE, so there is no source-backed signature to rely on.
Plan the update around the operational impact of rebooting the firewall, and ensure the device’s recovery or rollback procedure is understood before making the change. The key security outcome is to run the matching fixed release, not merely to disable a peer temporarily.
Rank #2
- Watchguard T125-W Firebox with 1 Year Standard Support License (WGT126001) - The T125-W adds Wi-Fi 7 capability to the powerful Firebox T125 platform. Designed for branch or remote offices, it delivers 510 Mbps UTM throughput, advanced security services, and full wireless coverage in a single, compact appliance.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: Wi-Fi 7 plus 1x 2.5Gb and 4x 1Gb Ethernet for coverage, clean uplinks, and straightforward VLAN segmentation with Cloud visibility.
- Performance and scale: UTM up to 510 Mbps with inspection on; add sites confidently with scalable VPN.
Is CVE-2026-86131 being exploited?
In its September 29, 2026 advisory, WatchGuard said it was not aware of exploitation in the wild. That statement describes the vendor’s knowledge at publication time; it does not establish that exploitation is impossible or rule out activity after disclosure. SecurityWeek reported on September 30 that the Fireware update set addressed 15 vulnerabilities, including this critical remote code-execution issue and 13 high-severity issues. Those broader update details do not change the branch-specific fix required for CVE-2026-86131.
Quick Recap
Best Value
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #4
- Watchguard T125 Firebox with 3 Year Basic Security Suite License (WGT125033) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #3
- Watchguard T145 Firebox with 1 Year Basic Security Suite License (WGT145031) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
