CVE-2026-86102
CriticalCVSS 9.3Summary
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Risk Assessment
Risk of full compromise of the access point and potentially the entire network where it is deployed. Arbitrary command execution can lead to loss of confidentiality, integrity, and availability.
Recommendation
Apply updates provided by WatchGuard for access points. Restrict network access to the internal API to trusted hosts only.
Other vulnerabilities in WatchGuard AP
See all- CVE-2026-87969High
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
- CVE-2026-101891Critical
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
Original NVD description (English source)
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS