How to Check Whether a WatchGuard Firebox Was Exposed to CVE-2026-86131

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To check a WatchGuard Firebox for CVE-2026-86131, identify its model and exact Fireware OS version, then compare both with WatchGuard’s affected-version table. A version in an affected range means the appliance ran vulnerable software; it does not, by itself, prove that the Firebox was attacked or compromised.

Check the Firebox model and Fireware OS version

1. Identify the model. Note the appliance’s exact model, especially whether it is a T15 or T35. WatchGuard gives those models a separate version threshold.
2. Record the installed Fireware OS version and branch. Use the device’s management interface or your inventory records. WatchGuard’s advisory does not specify a particular menu path for finding the version.
3. Compare the model, branch, and version with the table below. Use WatchGuard’s CVE-2026-86131 PSIRT record as the authoritative version reference; verify it is still current when making a change.

Which Fireware OS versions are affected?

WatchGuard’s PSIRT record, updated September 29, 2026, lists the following affected ranges and fixed-version thresholds:

#	Preview	Product	Price
1		WatchGuard Firebox T125 with 1 Year Standard Support - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports,...	$539.38	Buy on Amazon
2		WatchGuard Firebox T125-W with 1 Year Standard Support - Wi-Fi 7 Firewall, 1x 2.5Gb + 4X 1Gb Ports,...	$648.91	Buy on Amazon
3		WatchGuard Firebox T145 with 1 Year Basic Security Suite - Tabletop Firewall, 2.5Gb, 1Gb & SFP...	$955.29	Buy on Amazon
4		WatchGuard Firebox T125 with 3 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb...	$950.36	Buy on Amazon
5		WatchGuard Firebox T125 with 1 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb...	$609.24	Buy on Amazon

The model group and branch matter: do not apply the default-group 12.x threshold to a T15 or T35. For a fleet, check every appliance against the row matching its model group and installed branch; a threshold for one row does not establish coverage for another.

What an affected version does—and does not—tell you

CVE-2026-86131 is a code injection flaw in Fireware OS handling of BOVPN Over TLS client configuration. WatchGuard says an attacker controlling the remote VPN server can cause arbitrary commands to run as root on a connecting Firebox. The vendor rates it Critical, with a CVSS v4.0 score of 9.2, and maps it to CWE-94, improper control of code generation (code injection).

#1 Best Overall

WatchGuard Firebox T125 with 1 Year Standard Support - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250061)

• Watchguard T125 Firebox with 1 Year Standard Support License (WGT125001) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
• Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
• Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
• Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
• Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.

$539.38

Buy on Amazon

An affected version establishes that the appliance ran software WatchGuard lists as vulnerable. It does not establish that an attacker controlled its remote VPN server, that the Firebox connected to a malicious server, or that commands were executed.

What to do if a Firebox is in an affected range

1. Plan an upgrade to the applicable fixed release or a later applicable fixed release. Match the target to the appliance’s model group and branch.
2. Check compatibility and upgrade sequencing in WatchGuard’s current product documentation before changing a production appliance. The PSIRT record supplies vulnerability thresholds, not a device-specific upgrade plan.
3. For historical exposure or suspected compromise, preserve firmware and configuration history and use a qualified incident-response process. The advisory does not provide device-level forensic indicators or a serial-number lookup service.

WatchGuard’s reported exploitation status

In its September 29, 2026 advisory, WatchGuard stated, “WatchGuard is not aware of any exploitation of this vulnerability in the wild.” This describes the vendor’s awareness at that time; it is not a guarantee about an individual appliance or events after the advisory update.

Quick Recap

Bestseller No. 1

WatchGuard Firebox T125 with 1 Year Standard Support - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250061)

$539.38

Bestseller No. 2

WatchGuard Firebox T125-W with 1 Year Standard Support - Wi-Fi 7 Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Remote Offices (WGT126000+WGT1260061)

$648.91

Bestseller No. 3

WatchGuard Firebox T145 with 1 Year Basic Security Suite - Tabletop Firewall, 2.5Gb, 1Gb & SFP Ports, Enterprise Security for Branch Locations (WGT145000+WGT1450071)

$955.29

Bestseller No. 4

WatchGuard Firebox T125 with 3 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250073)

$950.36

Bestseller No. 5

WatchGuard Firebox T125 with 1 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250071)

$609.24

Best Value

WatchGuard Firebox T125 with 1 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250071)

• Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
• The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
• The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
• Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
• Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.

$609.24

Buy on Amazon

Rank #4

WatchGuard Firebox T125 with 3 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250073)

• Watchguard T125 Firebox with 3 Year Basic Security Suite License (WGT125033) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
• The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
• The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
• Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
• Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.

$950.36

Buy on Amazon

Rank #3

WatchGuard Firebox T145 with 1 Year Basic Security Suite - Tabletop Firewall, 2.5Gb, 1Gb & SFP Ports, Enterprise Security for Branch Locations (WGT145000+WGT1450071)

• Watchguard T145 Firebox with 1 Year Basic Security Suite License (WGT145031) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
• The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
• The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
• Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
• Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.

$955.29

Buy on Amazon

Rank #2

WatchGuard Firebox T125-W with 1 Year Standard Support - Wi-Fi 7 Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Remote Offices (WGT126000+WGT1260061)

• Watchguard T125-W Firebox with 1 Year Standard Support License (WGT126001) - The T125-W adds Wi-Fi 7 capability to the powerful Firebox T125 platform. Designed for branch or remote offices, it delivers 510 Mbps UTM throughput, advanced security services, and full wireless coverage in a single, compact appliance.
• Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
• Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
• Interfaces and deployment: Wi-Fi 7 plus 1x 2.5Gb and 4x 1Gb Ethernet for coverage, clean uplinks, and straightforward VLAN segmentation with Cloud visibility.
• Performance and scale: UTM up to 510 Mbps with inspection on; add sites confidently with scalable VPN.

$648.91

Buy on Amazon

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.