CVE-2026-86133 is a high severity integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS. A remote attacker who has completed the initial IKEv2 handshake can crash iked with a crafted encrypted message, causing denial of service. Fixed releases are Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
What's affected
WatchGuard's product status table lists these affected ranges:
- Default models: 2026.3 before 2026.3.2, 2025.0 before 2026.2.3, and 12.0 before 12.12.3
- T15 and T35 models: 12.0 before 12.5.21
The fixed versions are 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
Two source differences are worth knowing. First, severity: the record shows CVSS 3.1 7.5 (High), while WatchGuard's advisory shows High at 8.2 on CVSS 4.0. Second, wording: the record says the attacker must have completed the initial IKEv2 handshake, yet the advisory title calls the flaw pre-authentication. Treat it as reachable by any peer that can get through the handshake, and plan accordingly. WatchGuard states it knows of no exploitation in the wild, and the record is not in CISA KEV.
How to check if you're exposed
WatchGuard's advisory is the authority here. Read the Fireware OS version from the device (the system status view in the Fireware Web UI shows it) or from your central management console, then compare it with the table above.
If you run a fleet, export the OS version for every Firebox from your management tooling and sort by version. Anything on a branch listed above and below its fixed release needs an upgrade. Remember that T15 and T35 models follow their own fixed release, 12.5.21, not 12.12.3.
The advisory page did not describe a configuration setting that removes the exposure, so version is the check that matters. Do not assume a device is safe because the management interface is not published to the internet; confirm which services the box exposes and to whom.
What to do now
- Identify every WatchGuard Firebox in your estate and record its Fireware OS version.
- Upgrade to a fixed release for your branch: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35 models.
- Review which remote peers and tunnels can reach IKEv2 on each device, and remove any peer entries that are no longer needed.
- Schedule the upgrade in a maintenance window and keep a rollback image, since this is perimeter equipment.
- Record the change and the new version in your asset inventory so the next advisory is quick to triage.
Why it matters
This is another integer underflow (CWE-191), paired with CWE-1284, improper validation of a specified quantity in input. The daemon trusts a length field inside an encrypted IKEv2 message, subtracts from it, and ends up with a value that wraps around.
It sits next to CVE-2026-86132, which affects the same daemon and the same fixed releases. The difference is the precondition: this one needs a completed handshake, the other is triggered through an AES-GCM negotiation. Patching to the listed releases covers both, so there is no reason to split the work. The impact is a crashed VPN daemon, not a takeover.
Quick check
Is this the same bug as CVE-2026-86132?
No. They affect the same daemon and share fixed releases, but they are separate CVEs with different triggering conditions.
Does patching one branch fix the others?
No. Each branch has its own fixed release. Match the device to its branch, and give T15 and T35 models 12.5.21.
Sources
Last reviewed: 18 October 2026.
