WatchGuard has issued a firmware update addressing three vulnerabilities in its access points, two of which are rated critical and allow unauthenticated command execution on the device operating system.
The flaws affect firmware versions 1.0 through 3.4.7, with the fix available in version 3.4.8. The most severe issue, tracked as CVE-2026-86102 and rated 9.3 on the CVSS scale, is a command injection vulnerability in the internal API management service. An attacker with network access to a vulnerable device can trigger arbitrary shell commands without any authentication, valid session, or administrator interaction.
The second critical flaw, CVE-2026-101891, also scored at 9.3, stems from improper access control in the same internal service. It enables an unauthenticated attacker to interact with protected management functions, potentially leading to full device or network compromise.
The third vulnerability, CVE-2026-87969, carries a CVSS score of 8.6 and involves command injection via the command-line diagnostic interface. Unlike the other two issues, it requires authenticated administrator privileges to exploit.
Beyond the individual devices, a compromised access point can act as a persistent foothold inside corporate networks, providing visibility into traffic and a launch point for lateral movement against other systems.
The vulnerabilities were publicly disclosed on September 28. At the time of disclosure, no evidence of active exploitation or publicly available proof-of-concept code had been identified. Organizations are advised to update affected access points to firmware version 3.4.8 as soon as possible.
