CVE-2026-86102CWE-78CWE-863broken-access-controlcommand-injection

CVE-2026-86102

published September 28, 2026

CVSS
9.3
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01980 · 80.4th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-863 · Incorrect Authorization
Published
2026-09-28T21:17Z
References (1)
https://psirt.watchguard.com/CVE-2026-86102 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 30 SEP 03:29Z
    EPSS moved — → 2%
    epss
  • 28 SEP 16:51Z
    WatchGuard AP Command Injection in Internal Management API Allows Command Execution
    cvelistv5