WatchGuard TechnologiesCVE-2026-86102

WatchGuard AP: command injection

Critical9.3CVE-2026-86102 · Published Sep 28, 2026

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

WatchGuard Technologies advisory

Affected versions

Package	Affected	Fixed in
WatchGuard AP Product	>= 1.0, < 3.4.8	3.4.8

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-78, CWE-863

More WatchGuard Technologies advisories

All WatchGuard Technologies

Date	Advisory	Severity	Fixed in
Sep 30	WatchGuard Technologies Fireware OS: integer overflow High8.2Sep 30 CVE-2026-861322026.3.2+3 more	High8.2	2026.3.2+3 more
Sep 30	WatchGuard Technologies Fireware OS: resource exhaustion High7.1Sep 30 CVE-2026-181052026.3.2+3 more	High7.1	2026.3.2+3 more
Sep 30	WatchGuard Technologies Fireware OS: path traversal High8.2Sep 30 CVE-2026-1322412.5.21+3 more	High8.2	12.5.21+3 more
Sep 30	WatchGuard Technologies Fireware OS: unsafe deserialization High7.5Sep 30 CVE-2026-130462026.3.2+3 more	High7.5	2026.3.2+3 more
Sep 28	WatchGuard AP: command injection High8.6Sep 28 CVE-2026-879693.4.8	High8.6	3.4.8
Sep 28	WatchGuard AP: improper access control Critical9.3Sep 28 CVE-2026-1018913.4.8	Critical9.3	3.4.8

Affected versions

More WatchGuard Technologies advisories

Critical advisories by email