WatchGuard AP 3.4.8 Fixes Three Access and Command-Injection Vulnerabilities
Tech GuruQuick Answer
WatchGuard AP firmware 3.4.8 fixes three issues affecting releases from 1.0 up to, but not including, 3.4.8. They involve an internal API and the diagnostic CLI, not one interchangeable attack path. Scope the update to WatchGuard access points; this is not a Firebox firmware advisory.
Confirm Scope And Apply The Supported Fix
What to do now: schedule the supported AP firmware update while retaining site coverage and an alternate management path. Restrict management/API reachability to approved networks while updates are pending, but do not treat that restriction as a fix for an administrator-accessible CLI defect.
Last verified: October 2, 2026 UTC against the three WatchGuard PSIRT pages. No access point or client was tested.
Scope And Authority
| Product scope | WatchGuard AP releases from 1.0 through releases before 3.4.8 |
|---|---|
| Advisory | CVE-2026-101891 / CVE-2026-86102 / CVE-2026-87969 |
| CVEs | CVE-2026-101891, CVE-2026-86102, CVE-2026-87969 |
| Authoritative release date | 2026-09-28 16:51:27 UTC (WatchGuard PSIRT RSS publication time) |
| Authority revision date | 2026-09-28 (no later material revision stated by WatchGuard when verified) |
| Affected versions | WatchGuard AP releases from 1.0 through releases before 3.4.8. |
| Fixed version | WatchGuard AP 3.4.8 |
| CVSS base score | 8.6 / 9.3 (CVSS v4.0) |
| CVSS severity | High to Critical |
| Exploitation status | WatchGuard is not aware of exploitation of these vulnerabilities in the wild; no exploitation claim is inferred. |
What Changed
CVE-2026-101891 lets an unauthenticated attacker with network access obtain a valid API session. CVE-2026-86102 concerns OS-command injection through the internal management API by an attacker with network access. Both are rated 9.3 Critical under CVSS v4.0. CVE-2026-87969 requires an authenticated administrator using the diagnostic CLI and is rated 8.6 High.
What To Validate Now
- Identify each AP. Record device identity, firmware, site, management reachability and the SSIDs/VLANs it serves. Match the affected range instead of inferring scope from another WatchGuard product.
- Plan coverage and recovery. Preserve configuration and the supported recovery procedure. Arrange alternate coverage or a maintenance outage and onsite help where loss of the AP would also remove remote management.
- Deploy the fix. Use WatchGuard's supported channel for
3.4.8or a supported later fixed release. Read back the firmware on each device; a fleet-level queued or completed job alone does not prove every AP changed. - Test wireless service. Confirm authorized administration and normal diagnostics, client association/authentication, expected VLAN placement and required DHCP/DNS/connectivity. Do not exercise command-injection payloads on production.
- Track exceptions. Keep per-device versions and client test results. Record unreachable or failed APs separately from successfully updated ones.
Operational Cautions
Coordinate wireless changes to preserve site coverage and management reachability. WatchGuard says it is not aware of exploitation in the wild; that statement does not prove a particular environment is uncompromised.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
