CVE-2026-86131

A code injection flaw in WatchGuard's BOVPN Over TLS client lets attackers controlling the remote VPN server execute arbitrary root commands on the connecting Firebox.

An attacker controlling the remote VPN server can inject code into the BOVPN Over TLS client configuration, resulting in arbitrary root command execution on the Firebox. This is a critical RCE vulnerability that directly violates CMMC/NIST 800-171 requirements for preventing unauthorized access and protecting system integrity. DIB organizations must ensure all WatchGuard Fireware OS instances are patched immediately and monitor for active exploitation attempts.

Shame score — A critical RCE vulnerability in a widely deployed VPN client allows attackers controlling the remote server to execute arbitrary root commands, representing a severe avoidable failure in secure configuration handling.