Vulnerability in WatchGuard AP

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.3

[ Description ]Official description

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL7 Oct 2026NCSC-2026-0404

  Vulnerabilities fixed in WatchGuard Fireware OS Translated from Dutch

  Probability/damage M/HCVE-2026-13046CVE-2026-13224CVE-2026-13225+18 more CVEs

[ References ]References

• psirt.watchguard.com/CVE-2026-86102