WatchGuard

Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning

Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.

WatchGuard Fireware OS Affected by 15 Vulnerabilities Including Critical CVE-2026-86131

WatchGuard Technologies disclosed 15 vulnerabilities in Fireware OS, the operating system powering its UTM appliances. The advisories were published between September 29 and 30, 2026, covering issues that range from remote code execution and authorization bypass to file disclosure and denial of service. Impact varies by deployment, yet none of the flaws had been observed in active exploitation at disclosure time. The most severe finding, CVE-2026-86131 in BOVPN Over TLS, received a CVSS v4.0 base score of 9.2 and Critical rating. This code-injection flaw in client configuration handling allows an attacker who controls the VPN server to execute arbitrary commands with root privileges on the connecting Firebox device. The remaining vulnerabilities affect multiple components and are tracked under separate CVE identifiers listed in the official advisories.

WatchGuard Patches Critical API Flaws in Access Points Allowing Unauthenticated Command Execution

WatchGuard has released firmware version 3.4.8 to address three vulnerabilities affecting its access points, two of which are rated critical. The most severe issues, CVE-2026-86102 and CVE-2026-101891, both scored 9.3 on the CVSS scale and reside in the internal API management service. These flaws permit unauthenticated attackers with network access to execute arbitrary shell commands or bypass access controls without requiring any credentials or valid sessions. A third vulnerability, CVE-2026-87969 with a CVSS score of 8.6, involves command injection through the command-line diagnostic interface but requires authenticated administrator privileges. All firmware versions from 1.0 through 3.4.7 are impacted. The vulnerabilities were disclosed on September 28 with no evidence of active exploitation or public proof-of-concept code available at the time. A compromised access point could serve as an internal foothold for further network attacks due to its visibility into corporate traffic.

WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE

WatchGuard Technologies released security updates for its Firebox firewall products on August 27, 2026, addressing 11 vulnerabilities in Fireware OS. Nine of the flaws affect the IKE daemon (iked) and can lead to buffer overflows, out-of-bounds reads, and double-free conditions when processing crafted IKE messages. Three CVEs (CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318) may allow unauthenticated remote code execution due to memory corruption, with CVE-2026-19318 requiring the IKE payload diagnostic log to be enabled. An additional flaw, CVE-2026-13086, resides in the deprecated Mobile Security epm service and permits adjacent-network attackers with access to a trusted interface to execute arbitrary code as root without authentication. The company urges immediate application of Fireware versions 2026.2.2, 12.12.2, and 12.5.20.