CVE-2026-86134

Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service

Published Sep 30, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

Analysis

Technical impact

A NULL pointer dereference flaw in the authentication process of WatchGuard Fireware OS allows an unauthenticated remote attacker to crash the management daemon by sending a specially crafted request to the login interface. This causes a denial of service that interrupts remote management sessions. The underlying weakness is a null pointer dereference (CWE‑476), which leads the software to attempt to access uninitialized memory and crash.

Affected Systems

The vulnerability affects WatchGuard Fireware OS devices running any of the following versions: 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Devices running earlier releases that have not applied the listed updates are vulnerable.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity impact on availability, while the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The likely attack path involves an unauthenticated remote attacker sending a crafted packet to the management daemon’s login endpoint; no authentication is required, and the exploit can be performed from any network that can reach the device. If successful, the daemon will crash, causing a temporary loss of remote management functionality until a restart occurs.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WatchGuard

Fireware OS

unaffected

Version	Status	Constraints
`2026.3`	affected	< 2026.3.2
`2025.0`	affected	< 2026.2.3
`12.0`	affected	< 12.12.3

WatchGuard

Fireware OS

unaffected

Version	Status	Constraints
`12.0`	affected	< 12.5.21

Configuration 1 [-]

OR	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::
	cpe:2.3:o:watchguard:fireware::::::::

No data.

Vendor Product Versions

Watchguard

Fireware Os

Version	Status	Scheme	Platform
`[2026.3,2026.3.2)`	affected	generic	['default']
`[2025.0,2026.2.3)`	affected	generic	['default']
`[12.0,12.12.3)`	affected	generic	['default']
`[12.0,12.5.21)`	affected	generic	['t15/t35']

Watchguard

Fireware Os

Version	Status	Scheme	Platform
`[12.0,12.5.21)`	affected	generic	['t15/t35']

Remediation

Vendor Solution

Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21

OpenCVE Recommended Actions

Upgrade the device to WatchGuard Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 if it is not already at one of these releases.
Restrict access to the login interface by applying firewall rules or network segmentation so that only trusted network segments can reach the management daemon.
Monitor system logs for repeated crashes of the management daemon and apply a temporary restart script to maintain availability until a patch can be deployed.

Generated by OpenCVE AI on September 30, 2026 at 07:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.400% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://psirt.watchguard.com/CVE-2026-86134

History

Oct 6, 2026 5:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Watchguard fireware
CPEs		cpe:2.3:o:watchguard:fireware::::::::
Vendors & Products		Watchguard fireware
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 30, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 4:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.
Title		Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service
First Time appeared		Watchguard Watchguard fireware Os
Weaknesses		CWE-476
CPEs		cpe:2.3:a:watchguard:fireware_os::::::::
Vendors & Products		Watchguard Watchguard fireware Os
References		https://psirt.watchguard.com/CVE-2026-86134
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`