Fireware OS

WatchGuard Fireware OS Affected by 15 Vulnerabilities Including Critical CVE-2026-86131

WatchGuard Technologies disclosed 15 vulnerabilities in Fireware OS, the operating system powering its UTM appliances. The advisories were published between September 29 and 30, 2026, covering issues that range from remote code execution and authorization bypass to file disclosure and denial of service. Impact varies by deployment, yet none of the flaws had been observed in active exploitation at disclosure time. The most severe finding, CVE-2026-86131 in BOVPN Over TLS, received a CVSS v4.0 base score of 9.2 and Critical rating. This code-injection flaw in client configuration handling allows an attacker who controls the VPN server to execute arbitrary commands with root privileges on the connecting Firebox device. The remaining vulnerabilities affect multiple components and are tracked under separate CVE identifiers listed in the official advisories.

WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE

WatchGuard Technologies released security updates for its Firebox firewall products on August 27, 2026, addressing 11 vulnerabilities in Fireware OS. Nine of the flaws affect the IKE daemon (iked) and can lead to buffer overflows, out-of-bounds reads, and double-free conditions when processing crafted IKE messages. Three CVEs (CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318) may allow unauthenticated remote code execution due to memory corruption, with CVE-2026-19318 requiring the IKE payload diagnostic log to be enabled. An additional flaw, CVE-2026-13086, resides in the deprecated Mobile Security epm service and permits adjacent-network attackers with access to a trusted interface to execute arbitrary code as root without authentication. The company urges immediate application of Fireware versions 2026.2.2, 12.12.2, and 12.5.20.