CVE-2026-86102

9.3 criticalEPSS 2.3%

Critical (9.3). EPSS 2.3% chance of exploitation in the next 30 days.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-863
Published: 2026-09-28
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://psirt.watchguard.com/CVE-2026-86102

Check your stack JSON