CVE-2026-86134: Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service

Q: Does an attacker need valid credentials to exploit this issue?

No. The vulnerability can be triggered by a remote, unauthenticated attacker that can send a specially crafted request to the login interface.

Published Sep 30, 2026

Updated

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

Affected Software

5 affected components

WatchGuard Fireware OS

WatchGuard Fireware>=12.0<12.5.21

WatchGuard Fireware>=12.12<12.12.3

WatchGuard Fireware>=2025.0<2026.2.3

WatchGuard Fireware>=2026.3<2026.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.3.2
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 2026.2.3
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.12.3
Upgrade
Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.
Fixed in 12.5.21

Event History

Sep 30, 2026

CVE Published

via MITRE·03:37 AM

Data Sourced

via MITRE·03:37 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:18 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Does an attacker need valid credentials to exploit this issue?