WatchGuard security advisories, September 2026

Every WatchGuard security advisory published in September 2026, from WatchGuard PSIRT Advisories via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 20
Critical: 3
High: 16
In CISA KEV: 0
CVEs: 20

WatchGuard advisories published in September 2026

Sep 30, 2026
High [CVE-2026-86134] NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service
High8.7
Sep 29, 2026
Critical [CVE-2026-86131] code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox
Critical9.2
Sep 29, 2026
High [CVE-2026-86104] Fireware OS Resource Exhaustion in Login Process Allows Denial of Service
High8.7
Sep 29, 2026
High [CVE-2026-18145] stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request
High8.6
Sep 29, 2026
High [CVE-2026-86101] improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request
High7.2
Sep 29, 2026
High [CVE-2026-13046] deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file
High7.5
Sep 29, 2026
High [CVE-2026-13224] Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
High8.2
Sep 29, 2026
High [CVE-2026-86133] integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service
High8.2
Sep 29, 2026
High [CVE-2026-90441] Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
High7.1
Sep 29, 2026
High [CVE-2026-18105] Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service
High7.1
Sep 29, 2026
High [CVE-2026-86136] Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
High7.1
Sep 29, 2026
High [CVE-2026-86132] integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite
High8.2
Sep 29, 2026
High [CVE-2026-86128] Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
High8.2
Sep 29, 2026
High [CVE-2026-81433] stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet
High8.7
Sep 29, 2026
Medium [CVE-2026-86105] Fireware OS Improper Authorization in Access Portal Reverse Proxy
Medium5.3
Sep 28, 2026
Critical [CVE-2026-86102] OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system
Critical9.3
Sep 28, 2026
Critical [CVE-2026-101891] improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session
Critical9.3
Sep 28, 2026
High [CVE-2026-87969] OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input
High8.6
Sep 23, 2026
High [CVE-2026-95676] missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions
High7.4
Sep 8, 2026
High [CVE-2026-86135] Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page
High7.0

Get an email when WatchGuard publishes the next one.

See WatchGuard's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about WatchGuard

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.