CVE-2026-86133

Executive Summary

CVE-2026-86133 is an integer underflow (CWE-191) in the IKEv2 daemon (iked) of WatchGuard Fireware OS. A remote attacker who has already completed the initial IKEv2 handshake can send a specially crafted encrypted IKEv2 message that causes the iked process to crash, producing a denial-of-service condition on the affected firewall. Organizations running WatchGuard Fireware OS with IKEv2/IPsec VPN services exposed to untrusted networks are affected, and no patch, workaround, PoC, or exploit code is currently available from the tracked sources.

Technical Analysis

The vulnerability resides in the IKE key exchange daemon (iked) handling IKEv2 traffic on WatchGuard Fireware OS. The root cause is classified under CWE-191, Integer Underflow. An underflow occurs when a calculation subtracts a value from a smaller operand, wrapping the result to a very large unsigned value (or an unexpected negative signed value). In a network protocol parser, this commonly manifests when a length, count, or offset field embedded in the message is validated incorrectly and then used in a subtraction or buffer-bounds computation.

In this case the flaw is reachable only after the initial IKEv2 handshake has completed. This is a material detail: the attacker must possess a valid IKEv2 security association state and deliver the trigger as an encrypted IKEv2 message. The trigger therefore resides on the post-handshake processing path (for example, handling of an encrypted informational, notify, or delete payload), not in the initial cleartext negotiation. This raises the effective privilege required to reach the vulnerable code, reflected in the PR:L component of the assessed vector, while the network attack surface (AV:N) and low attack complexity (AC:L) keep exploitation straightforward for an attacker who can establish the handshake.

The observable outcome described is a crash of the iked process. A daemon crash terminates in-progress IKEv2 negotiations and drops the running IKEv2 service, causing a denial of service. There is no description of memory corruption, code execution, or information disclosure; the impact is availability only (C:N/I:N/A:H).

Because the precise arithmetic operation, payload type, and field offset are not disclosed in the provided data, no specific function names, payload identifiers, or offsets are asserted here. The description characterizes the mechanism at the class level: unvalidated length/count arithmetic in post-handshake IKEv2 message parsing leading to an integer underflow and process termination.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred from the vulnerability class and the details supplied in the NVD description.

1. Reconnaissance / target identification. The attacker identifies internet-reachable WatchGuard Fireware OS endpoints with IKEv2/IPsec enabled. IKEv2 negotiation uses UDP/500 (isakmp) and, when NAT traversal is in use, UDP/4500 (ipsec-nat-t). Shodan or equivalent scanning for these services on WatchGuard devices identifies candidate targets.

2. Handshake establishment. The attacker initiates a standard IKEv2 exchange with the target and completes the initial handshake, obtaining the negotiated security association and keys required to send encrypted post-handshake messages. This step is a precondition of the vulnerability, not the exploitation trigger.

3. Trigger delivery (vulnerability-class level). Over the established IKEv2 session, the attacker transmits a specially crafted encrypted IKEv2 message that exercises the vulnerable arithmetic. The underflow is induced by the maliciously formed message content. Per the source description, the craft is delivered as an encrypted IKEv2 message after the handshake; the exact payload structure is not disclosed.

4. Impact. The malformed message causes the iked process to crash, resulting in denial of service on the affected Fireware OS device. Repeated delivery could sustain the outage. No post-crash code execution or lateral movement is described; impact is limited to availability of the IKE/IPsec service (and any dependent VPN connectivity).

Impact Assessment

The vulnerability produces a denial of service against the IKEv2 daemon (iked) on WatchGuard Fireware OS. Availability impact is assessed as High (A:H); confidentiality and integrity impacts are None (C:N/I:N/A:H) based on the provided description. Network attack vector (AV:N) and low complexity (AC:L) are consistent with a remotely triggerable parser flaw, while the requirement to complete the initial handshake first justifies a privilege requirement of Low (PR:L). No scope change is indicated (S:U).

Business impact centers on VPN and site-to-site tunnel availability. A crash of iked can disrupt IKEv2-based IPsec connectivity for the appliance, potentially severing remote-access and branch connectivity. Because the trigger is post-handshake and requires IKEv2 exposure to untrusted networks, blast radius is limited to appliances with internet-facing IKEv2 services. No CVSS base score or vector was provided; the vector above is an inferred assessment and no authoritative score should be treated as published. EPSS has not been scored by FIRST.org for this CVE.

Detection Guidance

Sigma Rule

title: WatchGuard Fireware iked Crash via Crafted IKEv2 Message (CVE-2026-86133)
id: 5b8d1e2a-9c47-4f3e-b1a2-7d6c0e9f4a11
status: experimental
description: Detects crashes of the WatchGuard Fireware OS iked process following encrypted IKEv2 message handling, consistent with CVE-2026-86133 integer underflow DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86133
author: valtersit.com
logsource:
  product: watchguard
  service: fireware
detection:
  selection_process:
    - message|contains: 'iked'
  selection_event:
    - message|contains|all: ['iked', 'crash']
    - message|contains|all: ['iked', 'core dump']
    - message|contains|all: ['iked', 'terminated']
    - message|contains|all: ['iked', 'segfault']
  condition: selection_process and selection_event
falsepositives:
  - Legitimate iked restarts during maintenance or upgrade
level: high

YARA Rule

rule CVE_2026_86133_WatchGuard_iked_IKEv2_DoS
{
    meta:
        description = "Detects artifacts/log lines referencing WatchGuard Fireware iked crash tied to CVE-2026-86133"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86133"
        date = "2026-01-01"
    strings:
        $iked  = "iked" ascii wide nocase
        $ikev2 = "IKEv2" ascii wide nocase
        $crash1 = "iked process crashed" ascii wide nocase
        $crash2 = "iked terminated abnormally" ascii wide nocase
        $crash3 = "integer underflow" ascii wide nocase
    condition:
        uint16(0) == 0x213C or
        (filesize < 5MB and $iked and ($crash1 or $crash2 or $crash3))
}

Suricata IDS Rule

alert udp any any -> any 500 (msg:"CVE-2026-86133 WatchGuard Fireware iked possible IKEv2 DoS attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; dsize:>0; threshold:type both, track by_src, count 20, seconds 60; sid:9000001; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-86133, affected_product WatchGuard_Fireware;)
alert udp any any -> any 4500 (msg:"CVE-2026-86133 WatchGuard Fireware iked possible IKEv2 NAT-T DoS attempt"; flow:to_server; threshold:type both, track by_src, count 20, seconds 60; sid:9000002; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-86133, affected_product WatchGuard_Fireware;)

Note: IKEv2 payloads are frequently encrypted after the handshake, so network-layer detection of the exact malicious message is unreliable. These rules prioritize anomaly/rate signals against IKE ports; correlate with host-side iked crash telemetry.

Elastic Detection

process where event.type == "end" and process.name in ("iked") and
  process.exit_code != 0

sequence by host.id with maxspan=5m
  [process where process.name == "iked" and event.type == "start"]
  [process where process.name == "iked" and event.type == "end" and process.exit_code != 0]

Splunk SPL Query

index=firewall (sourcetype=watchguard OR sourcetype=fireware)
(process="iked" OR message="*iked*")
("crash" OR "core dump" OR "segfault" OR "terminated")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(message) as messages
        by src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="watchguard,fireware,ikev2,">
  <rule id="100510" level="10">
    <decoded_as>syslog</decoded_as>
    <match>iked</match>
    <regex>crash|core dump|segfault|terminated abnormally|integer underflow</regex>
    <description>CVE-2026-86133: WatchGuard Fireware iked process crash/abnormal termination (possible IKEv2 DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100511" level="8" frequency="3" timeframe="300">
    <if_matched_sid>100510</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-86133: Repeated WatchGuard iked crashes from same source (sustained IKEv2 DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict IKEv2/IPsec access on WatchGuard Fireware OS appliances to known, trusted source networks. Limit exposure of UDP/500 and UDP/4500 to the internet (allow only required peer ranges) to reduce the population of attackers who can complete the handshake precondition.
   • Where operationally acceptable, temporarily disable IKEv2/IPsec on internet-facing appliances and use alternate secure remote-access paths.
   • Monitor iked process health and configure alerting on crashes/restarts to detect attempts early.
   • Since exploitation requires a completed handshake, source-IP allow-listing and peer authentication hardening raise the bar; they do not eliminate the flaw.

2. Patch/upgrade steps

   • No patch or vendor advisory is identified in any tracked source for this CVE. Check the WatchGuard security advisory and Fireware OS release notes directly for a fixed firmware version, and apply it as soon as it is available.
   • Subscribe to vendor security notifications to receive patch notification promptly.

3. Long-term hardening

   • Keep Fireware OS current and maintain a firmware patch cadence for edge devices.
   • Enforce strong IKEv2 authentication, limit accepted peers, and reduce the attack surface of management/VPN interfaces.
   • Implement egress/ingress monitoring and rate-limiting on IKE ports, and retain iked crash telemetry for forensic correlation and continuous detection.

References

• NVD — CVE-2026-86133: https://nvd.nist.gov/vuln/detail/CVE-2026-86133
• CWE-191 — Integer Underflow (Wrap or Wraparound): https://cwe.mitre.org/data/definitions/191.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• WatchGuard Security Advisories and Fireware OS release notes: https://www.watchguard.com/wgrd-psirt/security-advisories
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or CISA KEV listing is available. No threat actor campaign or exploit-in-the-wild evidence has been identified in the provided data.