Authorization Flaw in wgagent Management Daemon by WatchGuard
CVE-2026-86136

7.1HIGH

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-86136?

A missing authorization vulnerability in the wgagent management daemon's session initialization function enables an authenticated, low-privileged user, such as a read-only or guest administrator, to potentially crash the wgagent process. This flaw allows the user to craft specific management API requests that can lead to unauthorized access to arbitrary files available to the daemon, posing significant security risks.

Affected Version(s)

Fireware OS Default 2026.0 < 2026.3.2

Fireware OS Default 2025.0 < 2026.2.3

Fireware OS Default 12.0 < 12.12.3

References

https://psirt.watchguard.com/CVE-2026-86136
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WatchGuard AI Security Research
.