CVE-2026-86128

Executive Summary

CVE-2026-86128 is a NULL pointer dereference vulnerability (CWE-476) in the NetFlow packet-processing feature of WatchGuard Fireware OS. A remote, unauthenticated attacker can trigger the flaw by sending a specially crafted IPv6 packet, causing the affected device to crash or become unresponsive. Because Fireware OS powers perimeter firewalls and security appliances, successful exploitation results in a denial-of-service condition that severs network protection and connectivity for all downstream users. The vulnerability is currently unpatched, with no public proof-of-concept, no exploit code, and no evidence of exploitation in the wild.

Technical Analysis

The vulnerability resides in Fireware OS's NetFlow packet-processing path. NetFlow export and flow-accounting features require the firewall to parse and process inbound flow records and related packet telemetry. In this case, the parsing routine handles IPv6 packets, and the defect causes the code path to dereference a NULL pointer when processing a specifically malformed IPv6 packet. A NULL pointer dereference in kernel or network-daemon context typically results in an immediate fault — a panic, a hard crash, or a service restart — rather than memory corruption that could be leveraged for code execution.

The attack surface is the device's network-facing IPv6 handling combined with the NetFlow feature set. Because the flaw is triggered during packet processing, no authentication or session establishment is required: an attacker only needs to be able to deliver an IPv6 packet to an interface on which the device performs NetFlow-related processing. The precise malformed structure required to reach the NULL dereference is not disclosed in the available intelligence, and no vulnerable function, structure, or field name is available. Analysis should therefore proceed at the vulnerability-class level: a missing or incomplete validation/initialization step leaves a pointer unset, and attacker-controlled IPv6 input reaches the dereference site.

Two conditions govern exposure. First, the NetFlow packet-processing feature must be enabled or reachable for the malformed packet to be parsed. Second, the device must accept IPv6 traffic — devices with IPv6 disabled or with no IPv6-enabled interface present a reduced (though not necessarily zero) risk profile. The absence of a CVE-assigned CVSS score from the vendor, and the fact that CWE-476 was assigned, are consistent with a remote denial-of-service rather than a confidentiality or integrity compromise.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-86128. The following chain is inferred from the vulnerability class (unauthenticated remote NULL pointer dereference in IPv6 NetFlow processing) and the NVD description, and does not rely on any unverified implementation detail.

1. Reconnaissance / target identification. An attacker identifies WatchGuard Fireware OS devices exposed on the internet, using fingerprinting of management interfaces, TLS certificate subjects, or application banners. Targets of interest are devices with IPv6 connectivity and NetFlow processing enabled. No credentials are required at any stage.

2. Triggering the flaw. The attacker sends a specially crafted IPv6 packet toward an affected interface. The packet is delivered to the NetFlow packet-processing path, where the malformed input reaches a code path that dereferences a NULL pointer. Because the flaw is a dereference defect rather than an injection defect, the attacker does not need to shape heap contents or bypass memory protections — reaching the vulnerable parse routine with the correct malformed structure is sufficient.

3. Payload / execution method. The "payload" is the malformed IPv6 packet itself; there is no shellcode, no command injection, and no privilege escalation step. The packet can likely be delivered with a single crafted datagram, meaning exploitation requires little bandwidth and no interactive session. A single packet may be sufficient, or a small number of packets may be needed depending on how the parser is entered.

4. Post-exploitation impact. The dereference causes a crash or hang of the affected processing component, resulting in a denial of service. Depending on the architecture, this may manifest as a full device reboot, a firewall process restart, or a sustained outage of the NetFlow/flow-accounting subsystem. The practical effect is loss of perimeter filtering, loss of connectivity for protected networks, and loss of flow telemetry for the duration of the outage. The attacker gains no code execution and no data access under this vulnerability class.

Impact Assessment

The primary impact is availability. A successful attack can take a perimeter security appliance offline — either through a crash and reboot or through a persistent unresponsive state — interrupting network connectivity and removing firewall enforcement for every system behind the device. Given the typical deployment position of Fireware OS at the network edge, the blast radius is potentially the entire protected network segment.

CVSS subscores (derived from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): Attack Vector is Network, meaning the flaw is exploitable remotely; Attack Complexity is Low, as no special conditions beyond reachability of the packet-processing path are indicated; Privileges Required is None and User Interaction is None, consistent with an unauthenticated packet-triggered crash. Confidentiality and Integrity impacts are None, reflecting the absence of a memory-corruption or data-disclosure primitive. Availability impact is High, because the outcome is loss of service on the device. No official CVSS score has been assigned by the vendor or NVD at the time of writing; the vector above reflects the vulnerability class and is provided for risk-scoring purposes only.

Because exploitation requires no authentication and low effort, the vulnerability is attractive to low-sophistication actors seeking disruption, including availability-focused denial-of-service campaigns against edge devices. There is, however, no current evidence of exploitation in the wild, no CISA KEV listing, and no known threat-actor campaign tied to this CVE.

Detection Guidance

Sigma Rule

title: Potential WatchGuard Fireware NetFlow IPv6 NULL Pointer Dereference DoS
id: 7f1c2a90-4b6e-4d21-9a3f-8c1e5b2d7f04
status: experimental
description: Detects crash, panic, or restart events in Fireware OS NetFlow/IPv6 packet processing indicative of CVE-2026-86128 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86128
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026.86128
logsource:
  product: watchguard
  service: fireware
detection:
  selection_crash:
    - 'NetFlow|panic'
    - 'NetFlow|crash'
    - 'NetFlow|fault'
    - 'NULL pointer|NetFlow'
    - 'kernel|panic|ipv6'
  selection_restart:
    - 'firewall|restart|unexpected'
    - 'process|terminated|netflow'
  condition: selection_crash or selection_restart
falsepositives:
  - Legitimate device reboots
  - Maintenance restarts of NetFlow export
level: high

YARA Rule

rule CVE_2026_86128_WatchGuard_NetFlow_IPv6_DoSCrash
{
    meta:
        description = "Detects crash or panic artifacts referencing NetFlow and IPv6 processing in WatchGuard Fireware OS logs, indicative of CVE-2026-86128 exploitation"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86128"
        date = "2026-01-01"
        cve = "CVE-2026-86128"
    strings:
        $nf1 = "netflow" nocase
        $nf2 = "NetFlow" nocase
        $ip6 = "ipv6" nocase
        $deref = "NULL pointer" nocase
        $panic = "panic" nocase
        $fault = "segfault" nocase
    condition:
        (uint16(0) == 0x0a0d or filesize < 5MB) and
        (any of ($nf1, $nf2)) and
        (any of ($ip6, $deref, $panic, $fault))
}

Suricata IDS Rule

alert ip any any -> $HOME_NET any (msg:"CVE-2026-86128 WatchGuard Fireware NetFlow IPv6 NULL Pointer Dereference DoS Attempt"; flow:to_server; ip_proto:41; classtype:attempted-dos; reference:cve,2026-86128; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86128; sid:90086128; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name with maxspan=5m
  [any where event.category == "network" and network.transport == "ipv6" and network.direction == "inbound"]
  [any where event.category == "process" and (process.name == "netflow" or process.command_line : "*netflow*") and event.outcome == "failure"]

Splunk SPL Query

index=watchguard OR index=firewall sourcetype=fireware:syslog
(("NetFlow" OR "netflow") AND ("panic" OR "crash" OR "fault" OR "NULL pointer" OR "segfault"))
OR ("ipv6" AND ("NetFlow" OR "netflow") AND ("terminated" OR "restart"))
| stats count min(_time) as first_seen max(_time) as last_seen by host src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="watchguard,fireware,cve-2026-86128,">
  <rule id="186128" level="12">
    <decoded_as>syslog</decoded_as>
    <match>NetFlow|netflow</match>
    <regex>panic|crash|fault|NULL pointer|segfault</regex>
    <description>CVE-2026-86128: WatchGuard Fireware NetFlow IPv6 NULL pointer dereference / potential DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability_attack,</group>
  </rule>
  <rule id="186129" level="10">
    <decoded_as>syslog</decoded_as>
    <match>netflow|NetFlow</match>
    <regex>ipv6|IPv6</regex>
    <match>restart|terminated|unexpected</match>
    <description>CVE-2026-86128: Fireware OS NetFlow/IPv6 process restart or termination</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix, no workaround, and no affected-version enumeration available at time of writing.

1. Immediate mitigations. Disable the NetFlow packet-processing / flow-accounting feature on Fireware OS appliances where it is not operationally required; this removes the parsing path that reaches the defect. Where IPv6 is not required, disable IPv6 processing on externally reachable interfaces to reduce exposure to IPv6-triggered parsing. Restrict external reachability of management and packet-processing interfaces using upstream ACLs or a separate filtering layer so that untrusted internet hosts cannot deliver crafted IPv6 packets directly to the appliance. Monitor device logs for unexpected reboots, panics, or NetFlow process terminations, and treat repeated unexplained restarts as potential exploitation attempts.

2. Patch / upgrade steps. No patch is currently available. Track WatchGuard's security advisories and Fireware OS release notes for a fix, and apply the vendor-released update as soon as it is published. Until then, deployment should assume the device can be forced offline by a single crafted IPv6 packet and should be architected accordingly (for example, redundant perimeter paths and failover).

3. Long-term hardening. Enforce the principle of least exposure on edge appliances: disable unused services and protocols, keep IPv6 disabled where it is not needed, and segment management planes away from untrusted networks. Maintain an inventory of edge devices with feature flags (such as NetFlow) recorded per device so that exposure can be reassessed quickly when advisories arrive. Establish subscription to vendor security bulletins and CISA advisory feeds, and rehearse an emergency change process for out-of-band edge device updates, since denial-of-service flaws in perimeter devices have an immediate operational impact.

References

• NVD — CVE-2026-86128: https://nvd.nist.gov/vuln/detail/CVE-2026-86128
• MITRE CWE-476 — NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• WatchGuard Security Advisories (vendor security bulletin index; no advisory for this CVE confirmed at time of writing): https://www.watchguard.com/wgrd-psirt/advisories
• FIRST EPSS (score not yet assigned for this CVE): https://www.first.org/epss/

No public proof-of-concept, exploitation code, or in-the-wild exploitation activity has been identified for CVE-2026-86128. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no threat-actor campaign has been attributed to it.