A NULL pointer dereference in the management interface of WatchGuard Fireware OS allows a remote, unauthenticated attacker with network access to the interface to crash the management service by sending a specially crafted login request. The crash terminates all active administrator sessions and interrupts any in‑progress management operations. The device’s traffic processing remains functional, but the attacker can effectively deny further management of the device, resulting in a denial of service for administrative purposes. This vulnerability matches the weakness types identified by CWE-1286, CWE-248, and CWE-476.

Any WatchGuard Fireware OS build older than the fixes announced in Fireware OS 2026.4, Fireware OS 12.12.4 and Fireware OS 12.5.22 is affected. These versions expose the vulnerability through the device’s web‑based management interface. The fix is included in the stated patch releases.

The vulnerability carries a CVSS score of 8.7, indicating a high severity level. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation prevalence is unknown. However, the attack path is straightforward: an attacker only needs network access to the management interface, no authentication, and the ability to send a specially crafted login packet. Upon successful exploitation, the attacker can permanently terminate all admin sessions and force a service restart, disrupting device management until a patch is applied. Traffic handling is unaffected.