Warning: Two critical vulnerabilities which can lead to Remote Code Execution in WatchGuard, Patch Immediately!

WatchGuard disclosed two critical vulnerabilities (CVE-2026-86102 and CVE-2026-101891) in WatchGuard AP firmware versions prior to 3.4.8 that allow unauthenticated remote attackers to execute arbitrary OS commands and obtain API sessions to take control of access points (both rated CVSS 9.3); WatchGuard and the Centre for Cybersecurity Belgium recommend urgent patching to 3.4.8 or later and increased monitoring, and as of 2026-09-29 no public proof-of-concept or evidence of active exploitation was reported.