Skip to main content

WatchGuard Fireware OS CVE-2026-13084

| EUVDEUVD-2026-41457 HIGH
NULL Pointer Dereference (CWE-476)
2026-07-02 WatchGuard GHSA-w44g-4gmf-m2ww
Watchguard Denial Of Service Microsoft Null Pointer Dereference Fireware Os
8.7
CVSS 4.0 · Vendor: WatchGuard
Share

Severity by source

Vendor (WatchGuard) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote unauthenticated IKEv2 message with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C:N/I:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 02, 2026 - 23:53 vuln.today
CVE Published
Jul 02, 2026 - 23:06 cve.org
HIGH 8.7

DescriptionCVE.org

A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2

AnalysisAI

Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sending specially crafted IKEv2 messages that trigger a null pointer dereference (CWE-476). The flaw affects appliances running Mobile User VPN with IKEv2 or Branch Office VPN over IKEv2 with a dynamic gateway peer, spanning Fireware OS 11.10.2 through 2026.2. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify internet-facing Firebox IKEv2 listener
Delivery
Craft malformed IKEv2 message
Exploit
Send to UDP 500/4500
Execution
Trigger null pointer dereference
Impact
Crash VPN service and drop tunnels
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Firebox must have IKEv2 VPN enabled in one of two modes: Mobile User VPN with IKEv2, or Branch Office VPN using IKEv2 configured with a dynamic gateway peer - appliances without IKEv2 VPN configured are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 (High) and is internally consistent: network-reachable, low complexity, no privileges, no user interaction, with impact confined to availability (VA:H) - there is no code execution or data disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the Firebox's internet-facing IKEv2 listener (UDP 500/4500) sends a crafted IKEv2 message that triggers the null pointer dereference in the VPN handler, crashing the service and dropping all VPN tunnels. No authentication, credentials, or user interaction are required, and the attacker needs only network reachability. …
Remediation Consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00024 for the fixed Fireware OS release and upgrade to a patched version beyond the affected ranges (past 11.12.4_Update1 in the 11.x line, past 12.12 in the 12.x line, and past 2026.2 in the current line); a specific fixed version was not included in the provided data, so treat the advisory as authoritative - Patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all WatchGuard appliances running Fireware OS 11.10.2-2026.2 with Mobile User VPN or Branch Office VPN over IKEv2 enabled; implement network-level rate limiting and source IP filtering on IKEv2 ports. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Watchguard

View all
CVE-2015-5453 MEDIUM POC
6.5 Jul 08

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
CVE-2015-5452 HIGH POC
7.5 Jul 08

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
CVE-2022-26318 CRITICAL POC
9.8 Mar 04

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
CVE-2018-10575 CRITICAL POC
9.8 Apr 30

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
CVE-2018-10577 HIGH POC
8.8 May 02

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
CVE-2016-7089 HIGH POC
7.8 Aug 24

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
CVE-2018-10576 HIGH POC
7.8 Apr 30

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
CVE-2017-14616 HIGH POC
7.5 Sep 20

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability

CVE-2017-8056 MEDIUM POC
5.3 Apr 22

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
CVE-2022-31790 HIGH POC
7.5 Sep 06

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
CVE-2020-10532 HIGH POC
7.5 Mar 12

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext password
CVE-2017-14615 MEDIUM POC
6.1 Sep 20

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-13084 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy