Is CVE-2026-86132 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86132 being exploited in the wild.

How severe is CVE-2026-86132?

Informational severity, published 30 September 2026.

Which products and versions are affected?

Watchguard Fireware OS 2026.3 < 2026.3.2, 2025.0 < 2026.2.3, 12.0 < 12.12.3; Watchguard Fireware OS T15/T35 12.0 < 12.5.21.

Is there a fix for CVE-2026-86132?

A patch was published on 2026-09-29: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86132 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-86132?

Check whether you run Watchguard Fireware OS or Watchguard Fireware OS T15/T35 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86132: WatchGuard Fireware OS integer underflow in IKEv2 daemon

Q: Is there a fix for CVE-2026-86132?

A patch was published on 2026-09-29: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-86132 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-86132?

Check whether you run Watchguard Fireware OS or Watchguard Fireware OS T15/T35 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86132 · Severity: info · Published 2026-09-30

WatchGuard Fireware OS is the operating system running on WatchGuard network firewalls, which protect enterprise networks and control traffic flow. An integer underflow vulnerability in the IKEv2 daemon allows a remote attacker without credentials to crash the firewall's VPN service by sending a specially crafted encrypted message, resulting in a denial of service and potential business disruption.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-86132 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86132 being exploited in the wild.
How severe is CVE-2026-86132?: Informational severity, published 30 September 2026.
Which products and versions are affected?: Watchguard Fireware OS 2026.3 < 2026.3.2, 2025.0 < 2026.2.3, 12.0 < 12.12.3; Watchguard Fireware OS T15/T35 12.0 < 12.5.21.
Is there a fix for CVE-2026-86132?: A patch was published on 2026-09-29: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86132 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-86132?: Check whether you run Watchguard Fireware OS or Watchguard Fireware OS T15/T35 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow (CWE-191) in the IKEv2 daemon (iked) occurs when processing encrypted IKEv2 messages negotiated with AES-GCM cipher suites. The vulnerability is pre-authentication and network-accessible, allowing an unauthenticated remote attacker to trigger a denial of service by crashing the iked process. No active exploitation in the wild has been reported.

Affected products

WatchGuard Fireware OS 2026.3 < 2026.3.2, 2025.0 < 2026.2.3, 12.0 < 12.12.3
WatchGuard Fireware OS T15/T35 12.0 < 12.5.21

Timeline

2026-09-29: disclosed
2026-09-29: patched: Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21 released

References

https://psirt.watchguard.com/CVE-2026-86132

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.