Which versions of WatchGuard Fireware OS are affected by CVE-2026-86134?

A high-severity flaw in WatchGuard Fireware OS allows anyone who can reach the Firebox management login interface to crash the management daemon without authenticating, temporarily taking the…. A patch is available.

How to fix or mitigate CVE-2026-86134?

Within 24 hours, inventory all WatchGuard Firebox and Fireware OS appliances, confirm which management/authentication interfaces are reachable from the internet or untrusted segments, and restrict that exposure to trusted administrative networks or VPN-only access; verify no public exploit code has appeared and monitor WatchGuard's advisory page for updates. Within 7 days, apply any vendor-supplied Fireware OS maintenance release or hotfix as soon as it is published, and in the interim enable management-interface allowlisting, login rate limiting, and alerting on repeated failed logins or daemon restarts so a crash attempt is detected and reported. Within 30 days, complete remediation across all instances, confirm the management daemon runs at a version WatchGuard identifies as fixed, integrate Firebox availability monitoring into the SOC, and add a recurring review of management-plane exposure for edge security devices to prevent recurrence.

WatchGuard Fireware OS CVE-2026-86134

Q: What is the CVSS score of CVE-2026-86134?

CVE-2026-86134 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-89605 HIGH

NULL Pointer Dereference (CWE-476)

2026-09-30 WatchGuard

GHSA-fhvg-p495-phcg

Denial Of Service Null Pointer Dereference Fireware Os Watchguard

8.7

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated remote crafted request to the login interface (AV:N/AC:L/PR:N/UI:N); availability-only daemon crash gives A:H with C:N/I:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 30, 2026 - 05:01 EUVD

Analysis Generated

Sep 30, 2026 - 04:20 vuln.today

CVE Published

Sep 30, 2026 - 03:37 cve.org

HIGH 8.7

DescriptionCVE.org

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

AnalysisAI

Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management daemon, producing a denial of service on affected Firebox appliances. The root cause is a NULL pointer dereference (CWE-476) triggered by a specially crafted request to the login endpoint; impact is confined to availability of the management daemon, with no confidentiality or integrity loss and no code execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the Fireware OS authentication/login interface of a WatchGuard Firebox; the attacker sends a specially crafted request to that login endpoint and needs no credentials, no user interaction, and no special configuration (PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch with an exact fix version is identified in the provided data; consult the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-86134 for the current fixed Fireware OS release and upgrade path, and apply the vendor's stated firmware update as soon as it is available (Fireware upgrades typically require a maintenance window and brief management-plane disruption). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WatchGuard Firebox and Fireware OS appliances, confirm which management/authentication interfaces are reachable from the internet or untrusted segments, and restrict that exposure to trusted administrative networks or VPN-only access; verify no public exploit code has appeared and monitor WatchGuard's advisory page for updates. …

Threat intelligence, references, and detailed analysis are available after sign-in.