CVE-2026-86134 is a high severity NULL pointer dereference in the Fireware OS authentication process. A remote, unauthenticated attacker can crash the management daemon by sending a crafted request to the login interface, causing denial of service. WatchGuard fixed it in 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
What's affected
The WatchGuard advisory lists the same affected ranges as its other September 2026 Fireware OS advisories:
- Default models: 2026.3 before 2026.3.2, 2025.0 before 2026.2.3, 12.0 before 12.12.3
- T15 and T35: 12.0 before 12.5.21
Fixed releases: 2026.3.2, 2026.2.3, 12.12.3, 12.5.21.
Severity differs by scoring system. The record has CVSS 3.1 at 7.5 (High). WatchGuard rates it High at 8.7 on CVSS 4.0. Both describe network reachable, no credentials, availability impact. WatchGuard says it is not aware of exploitation in the wild, and the CVE is not in CISA KEV.
How to check if you're exposed
WatchGuard's advisory is the authority here. Read the Fireware OS version from the device (the system status view in the Fireware Web UI shows it) or from your central management console, then compare it with the table above.
If you run a fleet, export the OS version for every Firebox from your management tooling and sort by version. Anything on a branch listed above and below its fixed release needs an upgrade. Remember that T15 and T35 models follow their own fixed release, 12.5.21, not 12.12.3.
The advisory page did not describe a configuration setting that removes the exposure, so version is the check that matters. Do not assume a device is safe because the management interface is not published to the internet; confirm which services the box exposes and to whom.
Because the flaw is in the login path, also check where the management interface is reachable. If it is exposed to the internet, treat this as urgent.
What to do now
- Identify every WatchGuard Firebox in your estate and record its Fireware OS version.
- Upgrade to a fixed release for your branch: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35 models.
- Restrict the management interface to trusted networks if it is currently reachable more widely, and confirm that with an external check.
- Schedule the upgrade in a maintenance window and keep a rollback image, since this is perimeter equipment.
- Record the change and the new version in your asset inventory so the next advisory is quick to triage.
Why it matters
A NULL pointer dereference (CWE-476) happens when code uses a pointer it never checked. Here the unauthenticated login handler hits that case on a malformed request, and the management daemon dies.
The login interface is reachable before anyone has authenticated, so the usual defence of strong passwords does nothing. Losing the management daemon does not necessarily stop traffic forwarding, and the advisory does not claim it does, but it can lock administrators out of the device when they most need access. The fix is the version upgrade; limiting who can reach the login page reduces exposure while you schedule it.
Quick check
Does the attacker need an account?
No. The record and the advisory both describe a remote, unauthenticated attacker.
Does this give code execution?
Neither source says so. Both describe a crash of the management daemon.
Sources
Last reviewed: 18 October 2026.
