WatchGuard Fireware OS CVE-2026-13368

Exploitation requires that the target Firebox has a Mobile VPN with IKEv2 configured AND that this VPN is set to authenticate against an external LDAP authentication server - this exact configuration is the necessary precondition; Fireboxes without Mobile VPN IKEv2, or ones using local/RADIUS authentication, are not exploitable through this path. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the attacker only needs network reachability to the IKEv2 responder. Exploitation is materially LIMITED by high attack complexity and a probabilistic attack requirement (AC:H/AT:P): the attacker must win a timing-dependent memory race, which is non-deterministic and typically demands repeated attempts, making reliable exploitation difficult and favoring determined/targeted actors. Affected versions are Fireware OS 11.0-11.12.4_Update1, 12.0-12.12, and 2025.1-2026.2.

This is a genuine high-priority issue for exposed Fireboxes with the affected feature set, but the raw 9.2 score should be read against its metric composition. The CVSS 4.0 vector shows network vector (AV:N), no privileges (PR:N), and no user interaction (UI:N) - meaning any internet-facing IKEv2 endpoint is reachable - while the high impact triad (VC:H/VI:H/VA:H) reflects full RCE within iked. Critically, AC:H combined with AT:P signals that exploitation is hard and success is probabilistic: winning a memory race remotely is non-deterministic and typically requires repeated attempts, which favors skilled/targeted actors over commodity mass exploitation. There is no CISA KEV listing and no public POC in the provided data, so exploitation is not confirmed in the wild. EPSS and SSVC data were not provided and cannot be cited. Net: treat as urgent for organizations whose Fireboxes expose Mobile VPN with IKEv2 + LDAP to the internet, and lower for those not running that configuration - the config dependency, not the CVSS number alone, should drive prioritization.

An attacker locates an internet-facing Firebox whose Mobile VPN with IKEv2 authenticates users via LDAP, then repeatedly initiates IKEv2 negotiations timed to trigger the authentication race condition. On a successful race, the freed object in iked is reused under attacker control, giving arbitrary code execution as the iked process without any valid credentials. No public POC is identified at time of analysis, and the AC:H/AT:P metrics imply many attempts may be needed before the race is won.