CVE-2026-86104 is a high severity denial of service flaw in the Fireware OS login process, wgagent. A remote, unauthenticated attacker can send a crafted request that consumes excessive resources. WatchGuard fixed it in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 for T15 and T35. Upgrade.
What's affected
- Product: WatchGuard Fireware OS.
- Affected (WatchGuard PSIRT): Fireware OS 2026.3 before 2026.3.2; 2025.0 up to before 2026.2.3; and 12.0 before 12.12.3. T15 and T35 models: 12.0 before 12.5.21.
- Fixed: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 for T15 and T35.
- Exploitation: WatchGuard says it is not aware of any exploitation in the wild. The record's KEV flag is also false.
Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). WatchGuard rates it High, 8.7 under CVSS v4. The record has 7.5 under CVSS v3.1.
Weakness class: CWE-400 (Uncontrolled Resource Consumption) CWE-409 (Improper Handling of Highly Compressed Data) CWE-770 (Allocation of Resources Without Limits or Throttling).
How to check if you're exposed
- Find the Fireware OS version on the Firebox, for example on the system status page of the Web UI, or in WatchGuard's management tools.
- Match it to the affected ranges above. Note that the affected range depends on the release family and the model.
- Look at Firebox logs for repeated login related requests and for unexplained restarts or a busy management process.
- Check whether the management or portal services face the internet, since that decides who can reach them.
What to do now
- Upgrade to the fixed Fireware OS release for your family: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35.
- Take a configuration backup before upgrading, and schedule a maintenance window.
- Limit management and portal access to trusted source addresses until the upgrade is done.
- Subscribe to WatchGuard PSIRT advisories so future fixes reach you quickly.
Why it matters
The weakness list is long: uncontrolled resource consumption (CWE-400), improper handling of highly compressed data (CWE-409) and allocation of resources without limits (CWE-770). WatchGuard also lists the attack patterns excessive allocation and exponential data expansion, which suggests a small request that expands into a large amount of work.
A firewall that stops responding is more than an inconvenience, because it sits in the path of traffic or in front of remote access. The fix is a software upgrade. Where you cannot upgrade right away, reduce who can reach the login service. The record and WatchGuard both say no exploitation in the wild is known.
Quick check
Does this need a login?
No. The attacker is unauthenticated, and the request is sent to the login process.
Sources
Last reviewed: 18 October 2026.
