Description
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
Published: 2026-09-29
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A NULL pointer dereference in the NetFlow packet‑processing code of Fireware OS can be triggered by a specially crafted IPv6 packet. An unauthenticated attacker can send that packet, causing the NetFlow component to crash and the device to become unresponsive, resulting in a denial of service for services relying on that feature.

Affected Systems

The vulnerability affects WatchGuard Fireware OS devices running versions prior to 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21, as identified by the patch releases.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity vulnerability; the EPSS score is not reported, and the issue is not listed in CISA's KEV catalog. Attackers can trigger the vulnerability remotely over the network by sending a crafted IPv6 packet to the device, with no authentication or privilege escalation required. While exploit availability is not confirmed, the lack of mitigations and the high impact make it a significant risk to network availability.

Generated by OpenCVE AI on September 30, 2026 at 08:08 UTC.

Remediation

Vendor Solution

Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21

OpenCVE Recommended Actions

  • Apply the latest Fireware OS patch (2026.3.2, 2026.2.3, 12.12.3, or 12.5.21) to fix the NULL pointer dereference in NetFlow IPv6 processing.
  • Reboot the device after the upgrade to ensure the NetFlow component restarts and the patch takes effect.
  • If the patch cannot be applied immediately, disable the NetFlow feature or block IPv6 traffic to the device to prevent the crafted packet from reaching the vulnerable component.

Generated by OpenCVE AI on September 30, 2026 at 08:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard fireware
CPEs cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
Vendors & Products Watchguard fireware
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
Title Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-476
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Fireware Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-09-30T15:28:13.992Z

Reserved: 2026-09-05T02:33:08.986Z

Link: CVE-2026-86128

cve-icon Vulnrichment

Updated: 2026-09-30T15:25:45.514Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-30T00:16:36.687

Modified: 2026-10-06T20:42:54.507

Link: CVE-2026-86128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T08:15:17Z

Weaknesses