EUVD-2026-89491
GHSA-34hp-73hm-xf3h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management API needing only a low-privileged/read-only admin account (PR:L), no UI; limited file read (C:L) and daemon crash (A:H), no integrity impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
AnalysisAI
Missing authorization in the wgagent management daemon of WatchGuard Fireware OS allows an authenticated, low-privileged management account - including read-only or guest administrator roles - to crash the daemon and read files accessible to its process by sending a crafted request to the management API. The weakness sits in the daemon's session-initialization function, which fails to enforce proper privilege validation before handling attacker-controlled input; the associated path-traversal class (CWE-22) is what enables the arbitrary file read, while the crash produces a denial-of-service condition against the agent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session on the Fireware OS management plane - specifically a low-privileged account, which the advisory explicitly notes may be a read-only or guest administrator, so even minimally-privileged management credentials suffice (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N) scores 7.1 (High), driven primarily by VA:H - the ability to crash the wgagent daemon (denial of service) - with a secondary limited confidentiality impact (VC:L) from arbitrary file read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified in the available data, and the WatchGuard PSIRT advisory (https://psirt.watchguard.com/CVE-2026-86136) should be monitored for the exact fixed Fireware OS version before administrators assume remediation is complete. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WatchGuard Fireware OS appliances and identify which expose their management plane beyond a trusted administrative network; restrict management interface access to a dedicated management VLAN or jump host with allow-listed source addresses, and immediately audit, disable, or suspend any guest and read-only administrator accounts that are not strictly required for operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today