CVE-2026-86132

Executive Summary

CVE-2026-86132 is an integer underflow vulnerability (CWE-191) in the IKEv2 daemon (iked) of WatchGuard Fireware OS. A remote, unauthenticated attacker can crash the iked process by sending a specially crafted encrypted IKEv2 message that has been negotiated using an AES-GCM cipher suite. Because the flaw is reachable pre-authentication over the network, any internet-exposed Fireware OS device with IKEv2 enabled is a potential target, and successful exploitation results in a denial-of-service condition affecting VPN/IPsec availability. No public proof-of-concept, exploit code, or vendor patch currently exists, and the CVE has not been scored by FIRST.org (EPSS) or added to CISA KEV.

Technical Analysis

The vulnerability resides in the IKEv2 daemon (iked) of WatchGuard Fireware OS. Per the NVD description, the root cause is an integer underflow (CWE-191), a class of defect in which an arithmetic operation on an unsigned (or insufficiently bounded) integer produces a value below the type's minimum representable value, causing wraparound to an unexpectedly large value. In memory-safety-sensitive code, an underflow of this kind typically corrupts length fields, offset calculations, or buffer-bound computations derived from attacker-influenced input.

The attack surface is the IKEv2 message-processing path that handles encrypted IKEv2 payloads negotiated under an AES-GCM cipher suite. AES-GCM is an AEAD construction: the ciphertext is accompanied by an authentication tag, and the associated length metadata (e.g., ciphertext length, padding, and the GCM tag length) is used by the parsing logic before or during decryption. An integer underflow in the handling of these length fields — for example, subtracting a fixed or attacker-influenced length from an input derived length without lower-bound validation — can yield a wrapped value that the daemon then uses to index, copy, or size a buffer.

Two properties make this notable:

1. Pre-authentication reachability. The description states the attacker is "remote, unauthenticated." IKEv2 negotiation and encrypted payload processing occur during the IKE_SA_INIT / IKE_AUTH exchange setup phase, before a security association is fully established and before peer identity is authenticated. This means the vulnerable code path is reachable without valid credentials or a pre-shared key.
2. Cipher-suite dependency. The trigger requires that the exchange be "negotiated with an AES-GCM cipher suite." This constrains the attack to configurations where AES-GCM is an offered/selected IKEv2 transform, which is common in modern IPsec deployments.

The net effect described is a crash of the iked process — a denial-of-service outcome. The NVD description does not state that remote code execution is achievable, and no memory-corruption-to-RCE path is asserted. Analysts should treat this as a DoS-class vulnerability with a confidentiality/integrity impact set of None and an availability impact of High under a standard CVSS v3.1 interpretation. Insufficient technical detail is available in the provided data to identify the exact length field, function, or buffer that underflows; the mechanism above is described at the vulnerability-class level only, consistent with the available evidence.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description. No public PoC is available; the attack chain is inferred from vulnerability class and description.

1. Reconnaissance / target identification. An attacker identifies internet-exposed WatchGuard Fireware OS devices with the IKEv2 service reachable. IKEv2 operates over UDP ports 500 (IKE) and 4500 (NAT-T), so exposed devices typically show these ports open. Shodan or similar scanners can be used with the dorks in METADATA above to enumerate candidate targets, and certificate/subject metadata can help fingerprint WatchGuard appliances.

2. Triggering the flaw class. The attacker initiates an IKEv2 exchange and negotiates a cipher suite that includes AES-GCM. Once AES-GCM is selected for the message, the attacker sends a "specially crafted encrypted IKEv2 message" whose encoded length metadata causes an integer underflow in the daemon's payload parsing. At the vulnerability-class level: an unchecked length subtraction wraps to a large value, and the iked process uses that corrupted value in a subsequent operation (e.g., a bounds check, copy length, or buffer index), producing an out-of-bounds or invalid-memory access.

3. Payload / execution method. The trigger is delivered purely as a network packet — no authentication, credentials, or user interaction is required. The "payload" is the crafted encrypted IKEv2 message itself, sent over UDP 500/4500. Because the ciphertext is encrypted, signature-based network inspection of payload contents is limited; detection must rely on protocol-anomaly and behavioral signals rather than clear-text pattern matching.

4. Post-exploitation impact. The immediate result is a crash of the iked process. Depending on the platform's service supervision, iked may restart automatically or remain down. While iked is unavailable, IKEv2/IPsec tunnel establishment (and re-establishment of existing tunnels) is disrupted — a denial-of-service condition. The description does not indicate code execution, data exfiltration, or persistence; those should not be assumed.

Impact Assessment

The impact is availability-focused. Under a standard CVSS v3.1 interpretation of the reported characteristics — network-reachable (AV:N), no privileges required (PR:N), no user interaction (UI:N), and a process crash (A:H) with no confidentiality or integrity loss (C:N/I:N) — the vector resolves to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (High, 7.5 base). Note: no official CVSS score or vector was provided for this CVE; the value above is a class-based estimate derived strictly from the described properties and must not be treated as a vendor or NVD-assigned score.

Blast radius. Any WatchGuard Fireware OS deployment that (a) exposes the IKEv2 iked service and (b) permits AES-GCM cipher negotiation is potentially affected. This includes site-to-site IPsec VPN gateways and remote-access/IPsec VPN concentrators. A crash of iked can interrupt VPN connectivity, which for many organizations carries downstream business impact: loss of branch/remote connectivity, disrupted failover, and potential operational impact on dependent services traveling over the tunnel.

Aggravating factors: internet exposure of UDP 500/4500, presence of AES-GCM in the IKEv2 transform set, and lack of process-level redundancy. Mitigating factors: the described outcome is a crash rather than RCE; no exploit code, PoC, or in-the-wild exploitation is currently known; the CVE is not in CISA KEV; and no EPSS score has been assigned.

Detection Guidance

Sigma Rule

title: Potential WatchGuard Fireware OS IKEv2 daemon crash (CVE-2026-86132)
id: 6f2c9c1a-3b7e-4e2f-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects abnormal termination/restart of the Fireware OS iked process consistent with an integer underflow DoS triggered by crafted AES-GCM IKEv2 messages.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86132
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: watchguard
  service: fireware
detection:
  selection_process:
    message|contains:
      - 'iked'
  selection_event:
    message|contains:
      - 'daemon'
      - 'crash'
      - 'core dump'
      - 'segfault'
      - 'restart'
      - 'exited'
  condition: selection_process and selection_event
falsepositives:
  - Legitimate iked restarts during firmware upgrade or maintenance
  - High-availability failover events
level: medium
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_86132_WatchGuard_iked_IKEv2_Underflow
{
    meta:
        description = "Heuristic detection for IKEv2 AES-GCM IKEv2 payloads targeting WatchGuard Fireware OS iked integer underflow (class-level; no public signature available)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86132"
        cve = "CVE-2026-86132"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        // IKEv2 header: initiator SPI (8 bytes) + responder SPI (8 bytes)
        // next payload = 0x2E (Encrypted and Authenticated) or 0x21..0x2B era markers
        $ike_header_encrypted = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2E }
        // Encrypted Fragment / Encrypted payload markers used near AEAD negotiation
        $encrypted_flag = { 2E ?? ?? ?? }
        // IKEv2 version marker (major 2): low nibble of byte 17 == 2
        $ikev2_ver = { ?? ?? 20 }

    condition:
        uint16(0) == 0x0000 or
        ( $ike_header_encrypted and $encrypted_flag and $ikev2_ver )
}

Note: because the triggering message is encrypted under AES-GCM, no reliable content signature can be written. The YARA rule above is a header-level heuristic only and should be tuned against real traffic.

Suricata IDS Rule

alert udp any any -> any 500 (msg:"CVE-2026-86132 WatchGuard Fireware OS IKEv2 iked potential AES-GCM underflow DoS attempt"; flow:stateless; dsize:>0; content:"|2e|"; offset:16; depth:1; byte_test:4,>,65535,28,relative; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-86132; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86132; sid:202686132; rev:1;)
alert udp any any -> any 4500 (msg:"CVE-2026-86132 WatchGuard Fireware OS IKEv2 iked potential AES-GCM underflow DoS attempt (NAT-T)"; flow:stateless; dsize:>0; content:"|2e|"; offset:16; depth:1; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-86132; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86132; sid:202686133; rev:1;)

Elastic Detection

sequence by host.id with maxspan=2m
  [ process where event.action == "start" and process.name : "iked" ]
  [ process where event.type in ("end","stop") and process.name : "iked" and
      (process.exit_code != 0 or process.exit_code != null) ]

Alternative single-event variant if sequence is unsupported:

process where process.name : "iked" and event.type : ("end","stop") and
  process.exit_code != 0 and process.parent.name : ("init","systemd","launchd")

Splunk SPL Query

index=watchguard (sourcetype="fireware" OR sourcetype="watchguard:firebox")
| search ("iked" AND ("crash" OR "core dump" OR "segfault" OR "restart" OR "exited" OR "terminated"))
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as evidence by host
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="watchguard,fireware,iked">
  <rule id="2026861" level="10">
    <decoded_as>watchguard-fireware</decoded_as>
    <match>iked</match>
    <regex>crash|core dump|segfault|exited abnormally|terminated</regex>
    <description>CVE-2026-86132: WatchGuard Fireware OS iked process abnormal termination (possible IKEv2 integer-underflow DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,ikev2,</group>
  </rule>
  <rule id="2026862" level="12" frequency="3" timeframe="120">
    <if_matched_sid>2026861</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-86132: repeated iked crashes from same source - likely active exploitation</description>
    <group>dos,ikev2,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict exposure of IKEv2 (UDP 500 and 4500) to trusted source networks only; block or rate-limit these ports from the public internet where remote IKEv2 from arbitrary peers is not required.
   • If remote-access IPsec from untrusted networks is not needed, disable IKEv2 on the external interface.
   • Where operationally feasible, remove AES-GCM transforms from the IKEv2 proposal set to avoid the precondition described in the CVE; validate that all peers support the remaining transforms before changing production policy.
   • Deploy upstream network filtering (provider ACLs, cloud security groups) to limit who can reach the IKEv2 service.
   • Monitor iked availability and configure alerting/auto-recovery for the process where the platform supports it.

2. Patch / upgrade steps

   • No patch or fixed version is available as of this report; no vendor advisory or fix has been identified from any tracked source.
   • Monitor WatchGuard's official security advisories and Fireware OS release notes for a patched firmware version, and track NVD for updates to CVE-2026-86132 (e.g., affected-version ranges, CVSS assignment, or vendor references).
   • When a fix is released, apply the firmware update during a maintenance window and verify iked stability post-upgrade.

3. Long-term hardening

   • Maintain an inventory of internet-exposed management and VPN interfaces; periodically re-scan using the Shodan dorks in METADATA to detect drift.
   • Adopt network segmentation so VPN termination interfaces are not directly reachable from untrusted networks.
   • Enable and retain verbose daemon and crash logs for post-incident forensics, and integrate appliance syslog into the SIEM with the detection rules above.
   • Track CISA KEV and vendor advisories for Fireware OS; incorporate firmware patching into a routine cadence.

References

• NVD — CVE-2026-86132: https://nvd.nist.gov/vuln/detail/CVE-2026-86132
• CWE-191 — Integer Underflow (Wrap or Wraparound): https://cwe.mitre.org/data/definitions/191.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• WatchGuard Security Advisories (vendor advisory hub — monitor for CVE-2026-86132): https://www.watchguard.com/wgrd-psirt/advisories
• CISA Known Exploited Vulnerabilities Catalog (currently does NOT list CVE-2026-86132): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, threat-actor campaign attribution, or public proof-of-concept was identified in the available data. The CVE is not listed in CISA KEV and has not been scored by FIRST.org (EPSS).