Vulnerability · Published Sep 28, 2026 · Assigned by WatchGuard
CVE-2026-86102WatchGuard AP Command Injection in Internal Management API Allows Command Execution
Critical 9.3
In plain English
A critical-severity OS command injection in WatchGuard AP from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)2.3%top 16.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | WatchGuard AP | 1.0 – before 3.4.8 |
Weakness: CWE-78, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://psirt.watchguard.com/CVE-2026-86102 vendor-advisory