CVE-2026-86128 is a high severity NULL pointer dereference in the NetFlow packet processing of Fireware OS. A remote, unauthenticated attacker can send a crafted IPv6 packet and cause denial of service. WatchGuard fixed it in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 for T15 and T35. Upgrade.
What's affected
- Product: WatchGuard Fireware OS.
- Affected (WatchGuard PSIRT): Fireware OS 2026.3 before 2026.3.2; 2025.0 up to before 2026.2.3; and 12.0 before 12.12.3. T15 and T35 models: 12.0 before 12.5.21.
- Fixed: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 for T15 and T35.
- Exploitation: WatchGuard says it is not aware of any exploitation in the wild. The record's KEV flag is also false.
Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). WatchGuard rates it High, 8.2 under CVSS v4. The record has 7.5 under CVSS v3.1.
Weakness class: CWE-476 (NULL Pointer Dereference).
How to check if you're exposed
- Find the Fireware OS version on the Firebox, for example on the system status page of the Web UI, or in WatchGuard's management tools.
- Match it to the affected ranges above. Note that the affected range depends on the release family and the model.
- Check whether NetFlow export is enabled on the Firebox, and whether it sees IPv6 traffic.
- Check whether the management or portal services face the internet, since that decides who can reach them.
What to do now
- Upgrade to the fixed Fireware OS release for your family: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35.
- Take a configuration backup before upgrading, and schedule a maintenance window.
- If you do not use NetFlow, consider turning it off until you have upgraded. The advisory names no workaround, so this is a precaution only.
- Subscribe to WatchGuard PSIRT advisories so future fixes reach you quickly.
Why it matters
A NULL pointer dereference happens when code uses a pointer without checking it is set, and the result is usually a crash. This one is CWE-476. WatchGuard links the attack pattern buffer overread. The trigger is a crafted IPv6 packet, so it comes from the data path, not a login.
For a firewall, a crash means a restart and a gap in protection. The affected feature is NetFlow, so deployments that never enabled it should carry less risk, though the advisory does not say so, and you should still upgrade. Both WatchGuard and the record state that exploitation in the wild is not known.
Quick check
Is turning off NetFlow a fix?
The advisory names no workaround. Turning it off may reduce exposure but is not a substitute for the fixed release.
Sources
Last reviewed: 18 October 2026.
