CVE-2026-86132: Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service
Published Sep 29, 2026
·Updated
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.5.21
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Remediation
Information
Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21
Patch Available
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
An attacker must be able to send a specially crafted encrypted IKEv2 message to the affected iked service. No authentication is required, but the message must have been negotiated with an AES-GCM cipher suite.
2
What is the expected impact of successful exploitation?
Successful exploitation crashes the IKEv2 daemon process, resulting in a denial of service for that process.