CVE-2026-86134

{
  "etk_id": "ETK-2026-93",
  "cve_id": "CVE-2026-86134",
  "display_id": "CVE-2026-86134",
  "ghsa_id": "GHSA-fhvg-p495-phcg",
  "euvd_id": "EUVD-2026-89605",
  "status": "published",
  "anchor_state": "anchored",
  "title": "NULL pointer dereference in Fireware OS authentication",
  "summary": "WatchGuard Fireware OS authentication handling is affected by a NULL pointer dereference. A remote unauthenticated attacker who can reach the login interface may cause the management daemon to crash, disrupting management access.",
  "mitigation": "Upgrade Fireware OS to 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21, as appropriate for the supported release train. Restrict access to the management login interface to trusted administrative networks until upgrades are complete.",
  "vendor": "WatchGuard",
  "product": "Fireware OS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2026.3, < 2026.3.2",
        ">= 2025.0, < 2026.2.3",
        ">= 12.0, < 12.12.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.3.2",
        "2026.2.3",
        "12.12.3"
      ],
      "package_name": "Fireware OS",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.0, < 12.5.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "12.5.21"
      ],
      "package_name": "Fireware OS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0038,
  "epss_percentile": 0.302,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.344933283333333,
  "t0_at": "2026-09-30T03:37:57.268000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T03:37:57.268000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T03:37:57.268000+00:00",
      "url": "https://github.com/advisories/GHSA-fhvg-p495-phcg"
    }
  }
}