CVE-2026-86128: Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
Published Sep 29, 2026
·Updated
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker only needs the ability to send a specially crafted IPv6 packet to the affected Fireware OS device. No authentication is required.
2
What is the likely impact of successful exploitation?
Successful exploitation can cause a denial of service through a NULL pointer dereference in NetFlow packet processing.