CVE-2026-86132 is a high severity integer underflow in the IKEv2 daemon (iked) of WatchGuard Fireware OS. A remote, unauthenticated attacker can crash the process with a crafted encrypted message negotiated with an AES-GCM cipher suite. WatchGuard fixed it in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
What's affected
Per the WatchGuard advisory, the default Fireware OS branches are affected as follows:
- 2026.3 up to but not including 2026.3.2
- 2025.0 up to but not including 2026.2.3
- 12.0 up to but not including 12.12.3
- T15 and T35 models: 12.0 up to but not including 12.5.21
Fixed releases are 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
On severity, the sources differ. The NVD style record carries CVSS 3.1 score 7.5 (High) with a network vector, no privileges and availability impact only. WatchGuard's own advisory rates it High at 8.2 on CVSS 4.0. Both agree on the class of impact: denial of service, with no confidentiality or integrity loss stated. WatchGuard says it is not aware of any exploitation in the wild, and the record does not list it in CISA KEV.
How to check if you're exposed
WatchGuard's advisory is the authority here. Read the Fireware OS version from the device (the system status view in the Fireware Web UI shows it) or from your central management console, then compare it with the table above.
If you run a fleet, export the OS version for every Firebox from your management tooling and sort by version. Anything on a branch listed above and below its fixed release needs an upgrade. Remember that T15 and T35 models follow their own fixed release, 12.5.21, not 12.12.3.
The advisory page did not describe a configuration setting that removes the exposure, so version is the check that matters. Do not assume a device is safe because the management interface is not published to the internet; confirm which services the box exposes and to whom.
What to do now
- Identify every WatchGuard Firebox in your estate and record its Fireware OS version.
- Upgrade to a fixed release for your branch: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35 models.
- Read the IKEv2 and VPN configuration on each device so you know which Fireboxes terminate IKEv2 tunnels. Those are the ones to patch first.
- Schedule the upgrade in a maintenance window and keep a rollback image, since this is perimeter equipment.
- Record the change and the new version in your asset inventory so the next advisory is quick to triage.
Why it matters
The weakness is an integer underflow (CWE-191). A length or size value is reduced below zero, wraps to a very large number, and the daemon then misbehaves. WatchGuard describes the result here as a process crash, not code execution.
The practical risk is availability. iked handles IKEv2 key exchange for VPN tunnels, so a crash can drop site to site or mobile VPN sessions until the process restarts. It is reachable without credentials, which is why the advisory is a priority for any firewall that accepts IKEv2 from the internet. The advisory credits WatchGuard's own AI security research as the finder.
Quick check
Does this need valid credentials?
No. The record and advisory describe a remote, unauthenticated attacker. The message must negotiate an AES-GCM cipher suite.
Is there a workaround?
The advisory page I reviewed lists upgrading as the solution and does not describe a workaround. Check the live advisory before relying on that.
Sources
Last reviewed: 18 October 2026.
