CVE-2026-86102
CriticalCVSS 9.3Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Risk Assessment
Risk of full compromise of the access point and potentially the entire network where it is deployed. Arbitrary command execution can lead to loss of confidentiality, integrity, and availability.
Recommendation
Apply updates provided by WatchGuard for access points. Restrict network access to the internal API to trusted hosts only.
Other vulnerabilities in WatchGuard AP
See all- CVE-2026-101891Critical
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
- CVE-2026-87969High
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
Original NVD description (English source)
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS