CVE-2026-86131

CriticalCVSS 9.8/10Last modified Oct 6, 2026

Description

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-295 CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-861327.5An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the CVE-2026-861337.5An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IK CVE-2026-861347.5A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to c CVE-2026-861357.0A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to t CVE-2026-861368.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil CVE-2026-861376.1In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.CVE-2026-861387.8In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.CVE-2026-861397.8In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.CVE-2026-86144.3The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce ver CVE-2026-861407.8In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.CVE-2026-861413.3xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate CVE-2026-861427.8In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.