Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-86102

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 3.4.8
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Affected versions

  • WatchGuard WatchGuard AP

    From 1.0 · fixed in 3.4.8

References 1

psirt.watchguard.com