CVE-2026-86102

CriticalCVSS 9.3/10Last modified Sep 28, 2026

Description

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-861047.5An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to c CVE-2026-861057.1An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal u CVE-2026-861069.6An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. Th CVE-2026-861075.9The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated over CVE-2026-861088.0Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized ma CVE-2026-861096.6The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does CVE-2026-86114.3The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including CVE-2026-861116.5BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read f CVE-2026-861125.4BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers CVE-2026-861136.5BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to mo CVE-2026-861146.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delet CVE-2026-861155.0Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation a