CVE-2026-86134
Received Received - Intake

NULL Pointer Dereference in WatchGuard Fireware OS Authentication

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WatchGuard Technologies, Inc.

Description
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-86134
EUVD
EUVD-2026-89605

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
watchguard fireware_os From 2025.0 (inc) to 2026.2.3 (exc)
watchguard fireware_os From 2026.3 (inc) to 2026.3.2 (exc)
watchguard fireware_os From 12.0 (inc) to 12.12.3 (exc)
watchguard fireware_os From 12.0 (inc) to 12.5.21 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in WatchGuard Fireware OS. It allows a remote, unauthenticated attacker to crash the management daemon by sending a specially crafted request to the login interface, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking the version of WatchGuard Fireware OS running on your system. Compare the installed version against the affected versions: >= 2026.3 and < 2026.3.2, >= 2025.0 and < 2026.2.3, >= 12.0 and < 12.12.3, or T15/T35 >= 12.0 and < 12.5.21. Use the management interface or CLI to verify the OS version.

Impact Analysis

The vulnerability can cause the management daemon to crash, leading to a denial of service. This disrupts access to the system's management interface and could affect network operations if not mitigated.

Compliance Impact

This vulnerability causes a denial of service by crashing the management daemon, which could disrupt security monitoring and logging systems. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could affect the integrity and availability of electronic protected health information systems, potentially compromising compliance with security rule requirements.

Mitigation Strategies

Immediately update WatchGuard Fireware OS to a patched version: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21. If updating is not possible, restrict access to the login interface by blocking external connections or using a firewall to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart