CVE-2026-86131

Executive Summary

CVE-2026-86131 is a code injection vulnerability (CWE-94) in WatchGuard Fireware OS affecting the BOVPN (Branch Office VPN) Over TLS client configuration handling. An attacker who controls the remote VPN server can execute arbitrary commands as root on the connecting Firebox appliance. Fireboxes configured to connect as BOVPN Over TLS clients to an external, attacker-controlled endpoint are at risk of full device compromise.

Technical Analysis

The vulnerability resides in the code path that processes BOVPN Over TLS client configuration. Fireware OS allows a Firebox to be configured as a client that establishes outbound VPN sessions over TLS to a remote server. Per the NVD description, the handling of this client configuration is vulnerable to code injection, meaning externally influenced input accepted during the client-side negotiation/configuration is not properly neutralized before being interpreted as executable logic.

CWE-94 (Improper Control of Generation of Code / "Code Injection") describes a class of flaws where an application constructs executable code using externally supplied data without adequate validation, escaping, or sanitization. In this instance, the trust boundary is inverted relative to the usual model: rather than an internet-facing attacker targeting the Firebox's own services, the attacker must already be positioned as the remote VPN server that the Firebox voluntarily connects to. Because the affected component runs with the privileges required to manage VPN configuration on the Firebox, successful injection results in execution of arbitrary commands as root.

Key characteristics derivable from the provided data:

• Attack vector: network (the remote VPN server is reached over the network).
• Required position: the attacker controls the peer server that the Firebox is configured to connect to.
• Privilege outcome: arbitrary command execution as root on the Firebox.
• Scope: the flaw is in client configuration handling — i.e., the Firebox acting as a BOVPN Over TLS client, not necessarily as a responder.

No public technical write-up, CVE title from the CNA, affected version list, or patch reference is available. Specific function names, configuration parameters, URL paths, or code symbols are not disclosed in the source data; the analysis above is therefore limited to the documented vulnerability class and trust model. No public PoC or exploit code has been observed.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level, as specific implementation details are not disclosed.

1. Reconnaissance / target identification: The attacker identifies Fireboxes that will connect to infrastructure they control, or that can be influenced to do so. In a real-world scenario this includes supply-chain, hosting-provider, or third-party-managed VPN endpoints, or any deployment where the remote BOVPN Over TLS peer is outside the victim's direct trust boundary. Public scanning for exposed Fireware management interfaces may complement this, but the core requirement is control of the remote VPN server.

2. Triggering the flaw: The victim Firebox is configured as a BOVPN Over TLS client pointing at the attacker-controlled server. When the Firebox initiates the tunnel and processes configuration data returned by that server, the crafted, externally supplied content is interpreted without sufficient neutralization — the CWE-94 code injection condition.

3. Payload / execution: Because the injected content is interpreted in an execution context, the attacker's data results in arbitrary commands being run on the Firebox. The NVD description explicitly states the commands execute as root.

4. Post-exploitation impact: With root on the Firebox, the attacker gains full control of the appliance — including firewall policy, VPN configuration, traffic inspection behavior, and any credentials or secrets resident on the device. The Firebox can then be used as a persistent foothold and pivot into the protected network it was meant to defend.

No public PoC is available; the attack chain is inferred from the vulnerability class and the trust relationship described in the NVD entry. Specific code patterns or function names cannot be stated because they have not been disclosed.

Impact Assessment

The impact is severe. Root-level arbitrary command execution on a perimeter security appliance dismantles the primary control the victim relies on. Blast radius considerations:

• Confidentiality (C:High): root access exposes stored credentials, certificates, VPN pre-shared secrets, configuration, and any inspected traffic metadata.
• Integrity (I:High): an attacker can rewrite firewall and VPN policy, disable inspection, or alter logging.
• Availability (A:High): the appliance can be disabled, bricked, or repurposed.
• Scope (S:Changed): control of the Firebox enables lateral movement and impact on systems behind it, exceeding the appliance itself.

The CVSS vector provided here (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network reachability, high attack complexity (the attacker must control the remote server and the victim must be configured to connect to it), no privileges or user interaction required, changed scope, and high impact across all three pillars. No official CVSS score or EPSS value has been published; the score field is N/A and EPSS is not yet scored.

Detection Guidance

Detection focuses on anomalous BOVPN Over TLS client behavior, unexpected command execution context on Fireboxes, and outbound connections to untrusted VPN peers.

Sigma Rule

title: WatchGuard Fireware BOVPN Over TLS Client Code Injection Attempt
id: 7a1c9f42-3d5e-4b21-9c8a-wg202686131
status: experimental
description: Detects configuration/negotiation anomalies consistent with code injection against Fireware OS BOVPN Over TLS client handling (CVE-2026-86131)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86131
author: valtersit.com
date: 2026/01/01
logsource:
  product: watchguard
  service: fireware
detection:
  selection_msg:
    - "BOVPN"
    - "Over TLS"
  selection_susp:
    - '|re|.*(;|\||&&|\$\(|`).*'
    - '|re|.*(cmd|sh|bash|/bin/).*'
  condition: selection_msg and selection_susp
falsepositives:
  - Legitimate diagnostic or maintenance strings in VPN configuration
level: high
tags:
  - attack.t1059
  - cve.2026.86131

YARA Rule

rule CVE_2026_86131_WatchGuard_BOVPN_TLS_CmdInjection
{
    meta:
        description = "Detects command-injection indicators in Fireware BOVPN Over TLS client config artifacts (CVE-2026-86131)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86131"
        date = "2026-01-01"
    strings:
        $bovpn = "BOVPN" ascii nocase
        $otls  = "Over TLS" ascii nocase
        $cmd1  = "$(" ascii
        $cmd2  = "`" ascii
        $cmd3  = "; " ascii
        $cmd4  = "&&" ascii
        $shell = "/bin/sh" ascii
    condition:
        ($bovpn or $otls) and any of ($cmd*)
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-86131 WatchGuard Fireware BOVPN Over TLS client code injection attempt"; flow:to_server,established; content:"BOVPN"; nocase; content:"Over TLS"; nocase; pcre:"/(;|\||&&|\$\(|`)/"; reference:cve,2026-86131; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86131; classtype:attempted-admin; sid:202686131; rev:1;)

Note: if BOVPN Over TLS uses a non-443 port, replace the destination port to match observed deployment.

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where vendor == "WatchGuard" and event.action like~ "BOVPN*" ]
  [ process where event.type == "start" and process.parent.name != null and
      process.args like~ ("*$(*", "*`*", "*&&*", "*/bin/sh*") ]

Splunk SPL Query

index=watchguard sourcetype=fireware ("BOVPN" OR "Over TLS")
| where match(_raw, "(?i)(\\$\\(|`|&&|\\|\\||/bin/sh|/bin/bash)")
| stats count earliest(_raw) latest(_raw) by src, dest, host
| where count > 0

Wazuh OSSEC Rule

<group name="watchguard,fireware,vpn,">
  <rule id="100861" level="12">
    <decoded_as>watchguard-fireware</decoded_as>
    <match>BOVPN|Over TLS</match>
    <regex>(;|\||&&|\$\(|`|/bin/sh)</regex>
    <description>CVE-2026-86131: Possible code injection in Fireware BOVPN Over TLS client handling</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is listed in the tracked data, and no affected/fixed version range has been published.

1. Immediate mitigations:

• Restrict BOVPN Over TLS client configurations to remote servers within your own trust boundary. Disable any client profile pointing to third-party, hosting-provider, or otherwise non-owned endpoints until the exposure is understood.
• Where the remote peer is not fully trusted, disable the BOVPN Over TLS client role entirely until a fix is available.
• Monitor Firebox outbound VPN client connections for unexpected destinations and alert on configuration changes to BOVPN profiles.
• Contact WatchGuard support to obtain authoritative status, since no public patch/version data exists in tracked sources.

2. Patch/upgrade steps:

• No patch reference exists. Do not assume a fixed version; verify directly with WatchGuard that a release addressing CVE-2026-86131 is available before upgrading, and apply it once confirmed.

3. Long-term hardening:

• Treat VPN peers and their returned configuration as untrusted input; enforce strict validation and least privilege in tunnel-processing components.
• Segment management access, monitor for unexpected root-level activity on appliances, and keep independent, off-device logging to detect post-exploitation tampering.
• Maintain a firmware inventory and subscribe to vendor advisories to reduce the window between disclosure and remediation.

References

• NVD — CVE-2026-86131: https://nvd.nist.gov/vuln/detail/CVE-2026-86131
• MITRE CWE-94 (Improper Control of Generation of Code / Code Injection): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1059 (Command and Scripting Interpreter): https://attack.mitre.org/techniques/T1059/
• WatchGuard Security Advisories portal (verify authoritative guidance): https://www.watchguard.com/wgrd-psirt/advisories
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-86131 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE. No public PoC or Nuclei template is available.