Which versions of WatchGuard Fireware OS are affected by CVE-2026-86128?

WatchGuard Fireware OS appliances that have NetFlow processing enabled and reachable over IPv6 are vulnerable to a remote denial-of-service condition that can crash the firewall and disrupt network…. A patch is available.

How to fix or mitigate CVE-2026-86128?

Within 24 hours, inventory all WatchGuard Fireware OS appliances to identify which have NetFlow processing enabled and reachable over IPv6, then immediately disable NetFlow processing or block IPv6 traffic to the NetFlow path using access control lists; monitor for unexpected reboots or failovers. Within 7 days, engage WatchGuard support to obtain the patch timeline and any hotfix, restrict IPv6 management access to trusted networks, and apply rate limiting or filtering on IPv6 traffic destined to the appliance. Within 30 days, apply the vendor-released patch as soon as it becomes available, validate that NetFlow over IPv6 is either disabled or patched, and review the broader IPv6 and NetFlow exposure across the estate to prevent similar availability risks.

WatchGuard Fireware OS CVE-2026-86128

Q: What is the CVSS score of CVE-2026-86128?

CVE-2026-86128 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-89489 HIGH

NULL Pointer Dereference (CWE-476)

2026-09-29 WatchGuard

GHSA-pch3-5p8f-436q

Denial Of Service Null Pointer Dereference Fireware Os Watchguard

8.2

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Remote unauthenticated (AV:N/PR:N/UI:N) but AC:H reflects the non-default NetFlow-enabled precondition (vendor AT:P); impact is availability-only crash, so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 30, 2026 - 02:01 EUVD

Analysis Generated

Sep 29, 2026 - 23:52 vuln.today

CVE Published

Sep 29, 2026 - 23:05 cve.org

HIGH 8.2

DescriptionCVE.org

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

AnalysisAI

Denial of service in WatchGuard Fireware OS lets remote, unauthenticated attackers crash the appliance by delivering a specially crafted IPv6 packet into its NetFlow packet-processing path, triggering a NULL pointer dereference (CWE-476). The flaw is availability-only (vendor CVSS 4.0 base 8.2, with VA:H and no confidentiality or integrity impact) and requires that NetFlow processing is actually configured and reachable over IPv6, so exposure is limited to deployments that enable that feature rather than to every Firebox. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the target WatchGuard Firebox to have the NetFlow packet-processing/export feature enabled and to process attacker-supplied IPv6 traffic - the AT:P attack requirement and the description's explicit reference to NetFlow indicate this is not a default-on, any-packet condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 4.0 score of 8.2 (High) reflects an availability-only impact (VA:H, with VC:N/VI:N) - this is a pure denial-of-service crash via NULL pointer dereference (CWE-476), not a code-execution or data-exposure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch was identified in the supplied intelligence, and the provided advisory reference (https://psirt.watchguard.com/CVE-2026-86128) should be checked directly for an updated Fireware OS build and the exact fixed version string before planning an upgrade. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WatchGuard Fireware OS appliances to identify which have NetFlow processing enabled and reachable over IPv6, then immediately disable NetFlow processing or block IPv6 traffic to the NetFlow path using access control lists; monitor for unexpected reboots or failovers. …

Threat intelligence, references, and detailed analysis are available after sign-in.