Is CVE-2026-86136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86136 being exploited in the wild.

How severe is CVE-2026-86136?

Informational severity, published 30 September 2026.

Which products and versions are affected?

Watchguard Fireware OS 2026.0 to <2026.3.2, 2025.0 to <2026.2.3, 12.0 to <12.12.3 (Default); 12.0 to <12.5.21 (T15/T35).

Is there a fix for CVE-2026-86136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86136 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-86136?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86136: WatchGuard Fireware OS missing authorization in wgagent management API

Q: Is there a fix for CVE-2026-86136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-86136 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-86136?

Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86136 · Severity: info · Published 2026-09-30

WatchGuard Fireware OS, which runs on network security appliances, contains a flaw in its management daemon that allows low-privileged users (including read-only administrators) to crash the daemon and read sensitive files. An authenticated attacker with minimal permissions can exploit this by sending a crafted API request, potentially exposing confidential data or disrupting firewall operations.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2026-86136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86136 being exploited in the wild.
How severe is CVE-2026-86136?: Informational severity, published 30 September 2026.
Which products and versions are affected?: Watchguard Fireware OS 2026.0 to <2026.3.2, 2025.0 to <2026.2.3, 12.0 to <12.12.3 (Default); 12.0 to <12.5.21 (T15/T35).
Is there a fix for CVE-2026-86136?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86136 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-86136?: Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The wgagent management daemon fails to properly authorize requests in its session initialization function, allowing authenticated low-privileged users to bypass access controls. The vulnerability combines path traversal (CWE-22), NULL pointer dereference (CWE-476), and missing authorization (CWE-862) flaws that can be triggered via the management API with a specially crafted request, enabling arbitrary file read and process crash.

Affected products

WatchGuard Fireware OS 2026.0 to <2026.3.2, 2025.0 to <2026.2.3, 12.0 to <12.12.3 (Default); 12.0 to <12.5.21 (T15/T35)

Timeline

2026-09-29: disclosed
2026-09-30: advisory

References

https://psirt.watchguard.com/CVE-2026-86136

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.