CVE-2026-86136 is a high severity missing authorization flaw in the wgagent management daemon of WatchGuard Fireware OS. A low-privileged authenticated user, including a read-only or guest administrator, can crash the process and read arbitrary files the daemon can access. Fixes: 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21.
What's affected
Per WatchGuard's product status table:
- Default models: 2026.0 before 2026.3.2, 2025.0 before 2026.2.3, 12.0 before 12.12.3
- T15 and T35: 12.0 before 12.5.21
Fixed releases are 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. Note that the affected range on the newest branch starts at 2026.0 here, a little wider than the IKEv2 advisories.
The severity numbers differ by source. The record shows CVSS 3.1 8.1 (High), with high confidentiality impact and a network vector. WatchGuard's advisory shows High at 7.1 on CVSS 4.0. The advisory is titled as a denial of service, Variant A, while the description also covers file read, so do not treat it as a crash only issue. No exploitation in the wild is reported by WatchGuard, and it is not in CISA KEV.
How to check if you're exposed
WatchGuard's advisory is the authority here. Read the Fireware OS version from the device (the system status view in the Fireware Web UI shows it) or from your central management console, then compare it with the table above.
If you run a fleet, export the OS version for every Firebox from your management tooling and sort by version. Anything on a branch listed above and below its fixed release needs an upgrade. Remember that T15 and T35 models follow their own fixed release, 12.5.21, not 12.12.3.
The advisory page did not describe a configuration setting that removes the exposure, so version is the check that matters. Do not assume a device is safe because the management interface is not published to the internet; confirm which services the box exposes and to whom.
This one needs a login, so also list your Fireware administrator accounts. Read-only and guest accounts are in scope for the attack, so every account counts, not only full admins.
What to do now
- Identify every WatchGuard Firebox in your estate and record its Fireware OS version.
- Upgrade to a fixed release for your branch: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 for T15 and T35 models.
- Review administrator accounts, remove unused read-only and guest logins, and rotate credentials for any you cannot account for.
- Schedule the upgrade in a maintenance window and keep a rollback image, since this is perimeter equipment.
- Record the change and the new version in your asset inventory so the next advisory is quick to triage.
Why it matters
The record lists three weakness classes: missing authorization (CWE-862), path traversal (CWE-22) and a NULL pointer dereference (CWE-476). Together they describe a session initialization function that does not check what the caller is allowed to do, accepts a path it should have restricted, and then crashes.
The interesting part is the privilege boundary. A read-only role is supposed to be harmless. Here it can read files the management daemon can reach, which on a firewall can include configuration data. That turns a low value account into a source of sensitive information, which matters if you hand out guest access to contractors or auditors. The fix is the upgrade, with account hygiene as a useful extra.
Quick check
Does the attacker need to log in?
Yes. The record describes an authenticated, low-privileged user, but that includes read-only and guest administrator accounts.
Why do the scores differ?
The record uses CVSS 3.1 and the vendor advisory uses CVSS 4.0. The scoring models weigh impact differently. Use the fixed version, not the number, to decide.
Sources
Last reviewed: 18 October 2026.
