CVE-2026-86102

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

CVSS

No CVSS.

References

Link	Resource
https://psirt.watchguard.com/CVE-2026-86102

Configurations

No configuration.

History

28 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 17:17

Updated : 2026-09-28 20:51

NVD link : CVE-2026-86102

Mitre link : CVE-2026-86102

CVE.ORG link : CVE-2026-86102

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-863

Incorrect Authorization

{"id": "CVE-2026-86102", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86102", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T17:19:49.821749Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "affectedData": [{"vendor": "WatchGuard", "product": "WatchGuard AP", "versions": [{"status": "affected", "version": "1.0", "lessThan": "3.4.8", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-28T17:17:51.267", "references": [{"url": "https://psirt.watchguard.com/CVE-2026-86102", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system."}], "lastModified": "2026-09-28T20:51:05.473", "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}

CVE-2026-86102

JSON object

Attach tags to CVE-2026-86102

Attach tags to `CVE-2026-86102`