Critical Fireware OS Code Injection CVE-2026-86131 with CVSS 9.2

🕵️ RESEARCH & DEEP DIVES

• Phishing campaigns abuse MSP360 RMM to deploy ScreenConnect for persistent access
  Microsoft observed phishing campaigns abusing MSP360 RMM to deploy ScreenConnect and establish redundant remote-access channels.
  • Targets organizations via phishing campaigns abusing remote monitoring and management (RMM) tools
  • Attackers abuse MSP360 RMM to deploy ScreenConnect
  • The setup creates redundant remote-access channels enabling persistent access and follow-on activity
  Sources 📎 Coverage: microsoft.com · 👁 via Microsoft Security Blog

🔓 CVEs & KEV

• CVE-2026-86131 — WatchGuard Fireware OS — CVSS 9.2 — Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execut...

• CVE-2026-86104 — WatchGuard Fireware OS — CVSS 8.7 — Fireware OS Resource Exhaustion in Login Process Allows Denial of ServiceAn u...

• CVE-2026-81433 — WatchGuard Fireware OS — CVSS 8.7 — Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote...

• CVE-2026-18145 — WatchGuard Fireware OS — CVSS 8.6 — Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution...

• CVE-2026-13224 — WatchGuard Fireware OS — CVSS 8.2 — Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local F...

• CVE-2026-86133 — WatchGuard Fireware OS — CVSS 8.2 — Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial...

• CVE-2026-86132 — WatchGuard Fireware OS — CVSS 8.2 — Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Ser...

• CVE-2026-86128 — WatchGuard Fireware OS — CVSS 8.2 — Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allow...

• CVE-2026-13046 — WatchGuard Fireware OS — CVSS 7.5 — Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Exe...

• CVE-2026-86101 — WatchGuard Fireware OS — CVSS 7.2 — Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Acc...

• CVE-2026-90441 — WatchGuard Fireware OS — CVSS 7.1 — Fireware OS Missing Authorization in wgagent Management API Allows Denial of ...

• CVE-2026-18105 — WatchGuard Fireware OS — CVSS 7.1 — Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Deni...

• CVE-2026-86136 — WatchGuard Fireware OS — CVSS 7.1 — Fireware OS Missing Authorization in wgagent Management API Allows Denial of ...

• CVE-2026-86105 — WatchGuard Fireware OS — CVSS 6.0 — Fireware OS Improper Authorization in Access Portal Reverse ProxyAn improper ...