CVE-2026-86133: WatchGuard Fireware OS IKE Daemon DoS Flaw

CVE-2026-86133 Overview

CVE-2026-86133 is an integer underflow vulnerability [CWE-191] in the WatchGuard Fireware OS Internet Key Exchange daemon (iked). A remote attacker who has completed the initial IKEv2 handshake can crash the iked process by sending a specially crafted encrypted IKEv2 message. Successful exploitation results in denial of service against the VPN termination component of the affected appliance.

The flaw impacts availability of IPsec VPN services on affected WatchGuard Firebox devices. Because iked handles all IKE negotiation, a crash disrupts existing tunnels and prevents new VPN sessions until the daemon restarts.

Critical Impact
A single crafted IKEv2 message after a valid handshake can crash the VPN daemon, breaking site-to-site and remote-access IPsec connectivity.

Affected Products

WatchGuard Fireware OS (IKE daemon iked)
WatchGuard Firebox appliances running vulnerable Fireware OS versions
IPsec IKEv2 VPN configurations terminated on affected devices

Discovery Timeline

2026-09-30 - CVE-2026-86133 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-86133

Vulnerability Analysis

The defect resides in the WatchGuard Fireware OS IKE daemon (iked), which handles IKEv2 negotiation and encrypted payload processing for IPsec VPNs. An integer underflow occurs while parsing an encrypted IKEv2 message received after the peer completes the initial handshake. The underflow corrupts subsequent length or index calculations, leading to a process crash.

Because iked centrally manages IKE state and cryptographic operations, its termination interrupts all active IKE sessions and prevents rekey and new tunnel establishment. The vulnerability is remotely reachable across the network attack surface exposed by the VPN endpoint.

Root Cause

The root cause is improper validation of a length or size field during parsing of an encrypted IKEv2 payload. When the field is smaller than an assumed baseline, an arithmetic subtraction wraps below zero and yields a very large unsigned value. That value is then used in memory or buffer computations that cause iked to abort.

Attack Vector

Exploitation requires the attacker to reach the IKE service (UDP/500 or UDP/4500) and complete a valid IKEv2 IKE_SA_INIT and IKE_AUTH exchange with the Firebox. After the security association is established, the attacker sends a crafted encrypted IKEv2 message that triggers the underflow. No user interaction is required, but authentication via a valid IKEv2 handshake is a prerequisite.

The vulnerability affects availability only; there is no reported impact to confidentiality or integrity of VPN traffic. Refer to the WatchGuard PSIRT advisory for CVE-2026-86133 for detailed technical context.

Detection Methods for CVE-2026-86133

Indicators of Compromise

Unexpected termination or repeated restarts of the iked process on WatchGuard Fireware OS devices.
IPsec tunnels dropping simultaneously with no corresponding administrative action or upstream network event.
IKEv2 peers logging repeated re-authentication attempts following an abrupt SA teardown.

Detection Strategies

Monitor Fireware OS system logs for iked crash, signal, or watchdog-restart entries.
Correlate IKEv2 tunnel drops with source IP addresses that recently completed IKE_AUTH exchanges.
Alert on bursts of malformed or oversized IKEv2 Encrypted (SK) payloads sourced from external peers.

Monitoring Recommendations

Enable SNMP or syslog forwarding from the Firebox to a centralized log platform for iked health metrics.
Track VPN tunnel uptime and IKE SA counters to detect anomalous rekey failures.
Baseline expected IKEv2 peer addresses and alert on new peers that establish handshakes shortly before daemon restarts.

How to Mitigate CVE-2026-86133

Immediate Actions Required

Apply the fixed Fireware OS release identified in the WatchGuard PSIRT advisory as soon as it is available for your appliance.
Restrict IKE service exposure (UDP/500 and UDP/4500) to known VPN peer addresses using geo or IP allow-lists.
Enforce strong IKEv2 authentication (certificates or strong PSKs) to reduce the population of attackers able to complete the initial handshake.

Patch Information

WatchGuard has published guidance and fixed version information in the vendor advisory. Review the WatchGuard PSIRT bulletin for CVE-2026-86133 to identify the Fireware OS release that resolves the underflow in iked and follow the vendor's upgrade procedure for your Firebox model.

Workarounds

Limit inbound IKE traffic to trusted peer IP ranges via firewall policy on upstream devices.
Disable IKEv2 remote-access profiles that are not required until patching is complete.
Configure automatic restart or high-availability failover so that an iked crash results in minimal VPN downtime.

bash

# Example: restrict IKE UDP ports to known peer subnets on an upstream device
# Replace TRUSTED_PEER_CIDR with your authorized VPN peer range
iptables -A INPUT -p udp --dport 500  -s TRUSTED_PEER_CIDR -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s TRUSTED_PEER_CIDR -j ACCEPT
iptables -A INPUT -p udp --dport 500  -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP