EUVD-2026-89495
GHSA-c7wr-f27v-pxx3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IKE but AC:H because the attacker must first complete an IKEv2 handshake to reach the flaw; impact is availability-only (iked crash), so C:N/I:N/A:H.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
AnalysisAI
An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS can be triggered by a remote, unauthenticated attacker who has already completed the initial IKEv2 handshake, causing the iked process to crash and interrupting IPsec VPN service. Only Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable are exposed; the flaw is confined to availability (no confidentiality or integrity impact), and the practical blast radius is narrower than the 8.2 base score suggests because a valid IKEv2 session state must exist before the crafted encrypted message can be delivered. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker first successfully complete the initial IKEv2 handshake with the target's IKE daemon (iked) on a WatchGuard Firebox running Fireware OS with IKEv2 IPsec VPN enabled and reachable; only after that session state exists can the specially crafted encrypted IKEv2 message trigger the CWE-1284 integer underflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.2 is driven almost entirely by the availability metric (VA:H) with no confidentiality or integrity impact - this is a pure denial-of-service flaw, not a code-execution or data-exposure issue, so the numeric severity overstates the practical blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data for CVE-2026-86133; consult the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-86133 for the current fixed Fireware OS build and upgrade path, and apply it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WatchGuard Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable from untrusted networks; consult the vendor advisory at https://psirt.watchguard.com/CVE-2026-86133 for affected Fireware OS versions and interim guidance; restrict IKEv2 VPN termination to trusted source IPs or disable IKEv2 if it is not operationally required; and enable alerting on iked process crashes or VPN service interruptions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today