Vulnerability · Published Sep 29, 2026 · Assigned by WatchGuard
CVE-2026-86128Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
High 8.2
In plain English
A high-severity null pointer dereference in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | Fireware OS | 2026.3 – before 2026.3.22025.0 – before 2026.2.312.0 – before 12.12.3 |
| WatchGuard | Fireware OS | 12.0 – before 12.5.21 |
Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://psirt.watchguard.com/CVE-2026-86128 vendor-advisory