EUVD-2026-89490
GHSA-cqp8-x8vw-vcr3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated (AV:N/PR:N/UI:N); AC:H reflects the AES-GCM-negotiation attack requirement; only the iked process crashes, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
AnalysisAI
Remote, unauthenticated denial of service in WatchGuard Fireware OS: an integer underflow (CWE-191) in the IKEv2 daemon (iked) is triggered when a remote attacker sends a specially crafted encrypted IKEv2 message within a session negotiated with an AES-GCM cipher suite, causing the daemon process to crash. Affected are Fireware OS deployments that terminate IPsec/IKEv2 VPNs on an interface reachable by the attacker - most commonly the WAN interface - and that offer or negotiate AES-GCM for IKEv2; deployments that do not use AES-GCM for IKEv2 are not on the vulnerable path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the WatchGuard Fireware OS IKEv2 daemon (iked), which is typically exposed on the WAN interface when IPsec/IKEv2 VPN is enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a denial-of-service-only vulnerability whose impact is confined to availability (CVSS 4.0 VA:H, with VC:N/VI:N and no subsequent-system impact SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched Fireware OS version is enumerated in the provided intelligence, so the first action is to check the vendor advisory at https://psirt.watchguard.com/CVE-2026-86132 and apply the firmware release it designates for this CVE; because the reported issue is a daemon crash, an HA failover or a restart of the IKEv2 service may restore availability but does not remove the exposure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WatchGuard Fireware OS deployments that terminate IPsec/IKEv2 VPNs on internet-reachable interfaces and confirm whether AES-GCM is offered or negotiated for IKEv2; where operationally feasible, remove AES-GCM from IKEv2 proposals, disable IKEv2/IPsec VPN on exposed interfaces if not required, and restrict VPN termination reachability to trusted source networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today