CVE-2026-87969 - Vulnerability Details - OpenCVE

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Watchguard Subscribe	Watchguard Ap Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

WatchGuard AP 3.4.8

Workaround

No workaround given by the vendor.

References

Link	Providers
https://psirt.watchguard.com/CVE-2026-87969

History

Mon, 28 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.
Title		WatchGuard AP Authenticated Command Injection in Diagnostic CLI
First Time appeared		Watchguard Watchguard watchguard Ap
Weaknesses		CWE-78
CPEs		cpe:2.3:a:watchguard:watchguard_ap::::::::
Vendors & Products		Watchguard Watchguard watchguard Ap
References		https://psirt.watchguard.com/CVE-2026-87969
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2026-09-28T16:51:22.069Z

Updated: 2026-09-28T18:02:56.619Z

Reserved: 2026-09-09T18:04:21.381Z

Link: CVE-2026-87969

Vulnrichment

Updated: 2026-09-28T17:53:11.850Z

NVD

Status : Received

Published: 2026-09-28T17:17:51.930

Modified: 2026-09-28T18:17:25.943

Link: CVE-2026-87969

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-78

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87969", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-09-09T18:04:21.381Z", "datePublished": "2026-09-28T16:51:22.069Z", "dateUpdated": "2026-09-28T18:02:56.619Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-28T16:51:22.069Z"}, "title": "WatchGuard AP Authenticated Command Injection in Diagnostic CLI", "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input."}], "affected": [{"vendor": "WatchGuard", "product": "WatchGuard AP", "versions": [{"status": "affected", "version": "1.0", "versionType": "semver", "lessThan": "3.4.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-87969", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:watchguard_ap:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "3.4.8"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78", "type": "CWE", "cweId": "CWE-78"}]}], "credits": [{"lang": "en", "value": "WatchGuard thanks Carlos Garrido of Pentraze Cybersecurity for working with us to protect our customers", "type": "finder"}], "configurations": [{"lang": "en", "value": "To exploit this vulnerability, an attacker must have access to the AP management CLI.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>To exploit this vulnerability, an attacker must have access to the AP management CLI.</p>"}]}], "solutions": [{"lang": "en", "value": "WatchGuard AP 3.4.8", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard AP 3.4.8"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T17:20:00.610815Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T18:02:56.619Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87969", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-09-09T18:04:21.381Z", "datePublished": "2026-09-28T16:51:22.069Z", "dateUpdated": "2026-09-28T16:51:22.069Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-09-28T16:51:22.069Z"}, "title": "WatchGuard AP Authenticated Command Injection in Diagnostic CLI", "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input."}], "affected": [{"vendor": "WatchGuard", "product": "WatchGuard AP", "versions": [{"status": "affected", "version": "1.0", "versionType": "semver", "lessThan": "3.4.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-87969", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:watchguard_ap:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "3.4.8"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78", "type": "CWE", "cweId": "CWE-78"}]}], "credits": [{"lang": "en", "value": "WatchGuard thanks Carlos Garrido of Pentraze Cybersecurity for working with us to protect our customers", "type": "finder"}], "configurations": [{"lang": "en", "value": "To exploit this vulnerability, an attacker must have access to the AP management CLI.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>To exploit this vulnerability, an attacker must have access to the AP management CLI.</p>"}]}], "solutions": [{"lang": "en", "value": "WatchGuard AP 3.4.8", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard AP 3.4.8"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T17:20:00.610815Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-28T17:53:11.850Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WatchGuard AP", "vendor": "WatchGuard", "versions": [{"lessThan": "3.4.8", "status": "affected", "version": "1.0", "versionType": "semver"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input."}], "id": "CVE-2026-87969", "lastModified": "2026-09-28T18:17:25.943", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87969", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T17:20:00.610815Z", "version": "2.0.3"}}]}, "published": "2026-09-28T17:17:51.930", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "url": "https://psirt.watchguard.com/CVE-2026-87969"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}