CVE-2026-86133
Watchguard Fireware: denial of service
- Risk score
- 55/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
- Affected
- Watchguard Fireware
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Watchguard Fireware: Amber, patch this week. A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
The flaws
- CVE-2026-86133: Denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-86131: Code injection (CVSS 9.8 · EPSS 0%)
- CVE-2026-86134: Null pointer dereference can lead to denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-86104: Denial of service (CVSS 7.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Watchguard Fireware
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-191 (CWE-191). 56 other warnings in 30 days
- Same product: Earlier Watchguard Fireware warnings. 10 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
Last activity 30 Sep 2026. Patch Forecast updates every hour.