Which versions of WatchGuard Fireware OS are affected by CVE-2026-13084?

A remote, unauthenticated denial-of-service vulnerability in WatchGuard Fireware OS (CVE-2026-13084) allows attackers to crash the IKEv2 VPN service, disrupting Mobile User VPN and Branch Office VPN…

How to fix or mitigate CVE-2026-13084?

Within 24 hours: Inventory all WatchGuard appliances running Fireware OS 11.10.2-2026.2 with Mobile User VPN or Branch Office VPN over IKEv2 enabled; implement network-level rate limiting and source IP filtering on IKEv2 ports. Within 7 days: Deploy intrusion detection rules to identify malformed IKEv2 messages; evaluate switching to IPSec-only VPN configuration if business operations permit. Within 30 days: Monitor WatchGuard security advisories for patch release; plan hardware refresh or evaluate alternative VPN appliances if no patch is available by month-end.

WatchGuard Fireware OS CVE-2026-13084

Q: What is the CVSS score of CVE-2026-13084?

CVE-2026-13084 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41457 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-02 WatchGuard

GHSA-w44g-4gmf-m2ww

Denial Of Service Null Pointer Dereference Microsoft Fireware Os Watchguard

8.7

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated IKEv2 message with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C:N/I:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:53 vuln.today

CVE Published

Jul 02, 2026 - 23:06 cve.org

HIGH 8.7

DescriptionCVE.org

A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2

AnalysisAI

Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sending specially crafted IKEv2 messages that trigger a null pointer dereference (CWE-476). The flaw affects appliances running Mobile User VPN with IKEv2 or Branch Office VPN over IKEv2 with a dynamic gateway peer, spanning Fireware OS 11.10.2 through 2026.2. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss.

Technical ContextAI

Fireware OS is the firmware powering WatchGuard Firebox network security appliances, which terminate IPsec/IKEv2 VPN tunnels for remote-access (Mobile User VPN) and site-to-site (Branch Office VPN) connectivity. IKEv2 (RFC 7296) is the key-exchange protocol that negotiates IPsec security associations over UDP 500/4500. The root cause is CWE-476, a null pointer dereference: the IKEv2 message-handling code dereferences a pointer that was never assigned or was freed when parsing a malformed or unexpected message, causing the process to fault and terminate. The CPE cpe:2.3:a:watchguard:fireware_os identifies the affected software as the Fireware OS application layer running on Firebox hardware and virtual appliances.

RemediationAI

Consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00024 for the fixed Fireware OS release and upgrade to a patched version beyond the affected ranges (past 11.12.4_Update1 in the 11.x line, past 12.12 in the 12.x line, and past 2026.2 in the current line); a specific fixed version was not included in the provided data, so treat the advisory as authoritative - Patch available per vendor advisory. As a compensating control until patching, restrict which source IPs can reach UDP 500/4500 on the Firebox external interface (feasible for Branch Office VPN with known peers, but this breaks Mobile User VPN for roaming clients on arbitrary IPs), or temporarily disable IKEv2 and fall back to another supported VPN protocol where feasible (this disrupts IKEv2 clients and dynamic-peer branch tunnels). Each mitigation trades VPN availability or reachability for reduced attack surface, so patching is strongly preferred over prolonged workarounds.