CVE-2026-86133: Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service
Published Sep 29, 2026
·Updated
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
Affected Software
5 affected components
WatchGuard Fireware OS
WatchGuard Fireware>=12.0<12.5.21
WatchGuard Fireware>=12.12<12.12.3
WatchGuard Fireware>=2025.0<2026.2.3
WatchGuard Fireware>=2026.3<2026.3.2
Remediation
Information
Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21
Patch Available
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need before they can trigger the denial of service?
The attacker must complete the initial IKEv2 handshake and then send a specially crafted encrypted IKEv2 message to the iked daemon.
2
What is the operational impact of successful exploitation?
Successful exploitation crashes the iked process, causing a denial of service.