Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
WatchGuard has fixed CVE-2026-86131, a critical Fireware OS code-injection flaw that can let an attacker controlling a remote BOVPN Over TLS server run commands as root on a connecting Firebox. Install the fixed Fireware release for your appliance’s branch: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15/T35 devices.
What is CVE-2026-86131?
WatchGuard disclosed CVE-2026-86131 on September 29, 2026, and rated it CVSS v4.0 9.2, Critical. The vulnerability is in how the Fireware OS BOVPN Over TLS client handles configuration. An attacker who controls the remote VPN server can inject code that executes arbitrary commands as root on the connecting Firebox. WatchGuard’s advisory and the CVE record describe the issue.
The attack path is conditional: the attacker must control the remote VPN server. The impact on a connecting vulnerable Firebox is nevertheless root-level command execution.
Which Fireware versions are affected, and what fixes them?
WatchGuard’s advisory lists the following affected version ranges and fixed releases. Apply the fix matching the device’s platform branch, rather than choosing a release based only on its version number.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
WatchGuard Firebox T125 with 1 Year Standard Support - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250061)
- Watchguard T125 Firebox with 1 Year Standard Support License (WGT125001) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
| Platform branch | Affected Fireware versions | Fixed release |
|---|---|---|
| Default | 2026.3 through versions before 2026.3.2 | 2026.3.2 |
| Default | 2025.0 through versions before 2026.2.3 | 2026.2.3 |
| Default | 12.0 through versions before 12.12.3 | 12.12.3 |
| T15/T35 | 12.0 through versions before 12.5.21 | 12.5.21 |
The affected ranges and fixes are listed in WatchGuard’s September 29 advisory and corroborated by the CVE.org record. If a device’s branch or eligibility is unclear, verify it against WatchGuard’s advisory and the device’s supported update options before upgrading.
What should Firebox administrators do?
- Inventory affected devices. Identify each Firebox’s model and running Fireware branch, including T15 and T35 appliances.
- Install the matching fixed release. Upgrade to 2026.3.2, 2026.2.3, 12.12.3, or, for the T15/T35 branch, 12.5.21 as applicable to that device.
- Verify the upgrade. After reboot, confirm the running Fireware version and record the device model and branch.
- Review the VPN trust relationship. Check which remote servers are trusted and review BOVPN Over TLS peer configuration, since control of the remote VPN server is central to the attack path.
- Check monitoring and logs. Look for unexpected VPN-server behavior or commands around the disclosure period. The cited public sources do not provide a specific exploit or a complete set of indicators for this CVE, so use your normal incident-response process rather than relying on an assumed signature.
Is exploitation happening in the wild?
When WatchGuard published its advisory on September 29, 2026, it said it was not aware of exploitation in the wild. That statement reflects the vendor’s knowledge at publication time; it does not rule out exploitation after disclosure. WatchGuard advisory
Rank #2
WatchGuard Firebox T125-W with 1 Year Standard Support - Wi-Fi 7 Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Remote Offices (WGT126000+WGT1260061)
- Watchguard T125-W Firebox with 1 Year Standard Support License (WGT126001) - The T125-W adds Wi-Fi 7 capability to the powerful Firebox T125 platform. Designed for branch or remote offices, it delivers 510 Mbps UTM throughput, advanced security services, and full wireless coverage in a single, compact appliance.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: Wi-Fi 7 plus 1x 2.5Gb and 4x 1Gb Ethernet for coverage, clean uplinks, and straightforward VLAN segmentation with Cloud visibility.
- Performance and scale: UTM up to 510 Mbps with inspection on; add sites confidently with scalable VPN.
SecurityWeek reported on September 30, 2026, that the Fireware update set fixed 15 vulnerabilities, including this critical remote-code-execution issue and 13 high-severity issues. SecurityWeek’s report also describes the root-command-execution risk when an attacker controls the VPN server.
Quick Recap
Best Value
WatchGuard Firebox T125 with 1 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250071)
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #4
WatchGuard Firebox T125 with 3 Year Basic Security Suite - Tabletop Firewall, 1x 2.5Gb + 4X 1Gb Ports, High-Speed Security for Branch Offices (WGT125000+WGT1250073)
- Watchguard T125 Firebox with 3 Year Basic Security Suite License (WGT125033) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Rank #3
WatchGuard Firebox T145 with 1 Year Basic Security Suite - Tabletop Firewall, 2.5Gb, 1Gb & SFP Ports, Enterprise Security for Branch Locations (WGT145000+WGT1450071)
- Watchguard T145 Firebox with 1 Year Basic Security Suite License (WGT145031) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone. 
