The vulnerabilities include CVE-2026-101891, an improper access control flaw in the device API service that permits unauthenticated access. Additionally, CVE-2026-86102 enables command injection via the internal management API, potentially allowing attackers to execute unauthorized commands. Finally, CVE-2026-87969 involves an authenticated command injection vulnerability within the diagnostic Command Line Interface (CLI). Successful exploitation of these vulnerabilities could result in full device compromise, enabling attackers to gain unauthorized persistence within the managed network environment. Administrators are advised to update affected hardware to firmware version 3.4.8 or later immediately.

Impact

Successful exploitation of these vulnerabilities allows for unauthorized access and arbitrary command execution on WatchGuard access points. Given their role in enterprise network access, compromised APs could facilitate further lateral movement, traffic interception, or the permanent disruption of network services.

Recommendation

• Apply the firmware update to version 3.4.8 or later on all impacted WatchGuard AP units as documented in the WatchGuard PSIRT advisory.
• Restrict network management access to AP devices to authorized administrative subnets only.
• Audit logs for anomalous POST requests or diagnostic CLI activity on networking hardware.