Which versions of WatchGuard Fireware OS are affected by CVE-2026-13368?

WatchGuard Fireware OS running Mobile User VPN with IKEv2 and external LDAP authentication contains a critical remote code execution vulnerability affecting the firewall device itself, with no vendor…

How to fix or mitigate CVE-2026-13368?

Within 24 hours: Audit all WatchGuard Fireboxes to identify systems with Mobile User VPN enabled using IKEv2 and external LDAP authentication and quantify exposure. Within 7 days: Implement compensating controls (detailed below) for all affected systems and restrict IKEv2 access to known trusted client IP ranges; while no public exploit identified at time of analysis, prompt action is critical to secure the attack surface before exploit code emerges. Within 30 days: Monitor WatchGuard security advisories for patch release and prepare testing procedures for immediate deployment upon availability.

WatchGuard Fireware OS CVE-2026-13368

Q: What is the CVSS score of CVE-2026-13368?

CVE-2026-13368 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-41456 CRITICAL

Use After Free (CWE-416)

2026-07-02 WatchGuard

GHSA-fp7c-rxxp-rx8q

Memory Corruption Watchguard Use After Free RCE Fireware Os

9.2

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Remote unauthenticated network reach (AV:N/PR:N/UI:N) but a hard-to-win memory race raises AC:H; full RCE in iked gives C/I/A:H with no scope change (SC/SI/SA=N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:52 vuln.today

DescriptionCVE.org

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticates against an external LDAP server. A race condition in the IKEv2 LDAP authentication path can be driven into a use-after-free (CWE-416) inside the iked daemon, letting a remote unauthenticated attacker execute arbitrary code in the context of that process. No public exploit identified at time of analysis, and the CVSS 4.0 base score of 9.2 is tempered by high attack complexity and a probabilistic attack requirement (AC:H/AT:P), reflecting the difficulty of reliably winning the race.

Technical ContextAI

The vulnerable component is iked, the IKEv2 daemon in WatchGuard's Fireware OS that terminates Mobile User VPN (IKEv2) tunnels. When the VPN is configured to authenticate remote users against an external LDAP directory, the daemon coordinates concurrent authentication state; the flaw is a race condition (concurrent execution using shared resources without proper synchronization) that allows a memory object to be freed while another execution path still references it, yielding a classic CWE-416 use-after-free. Because iked parses attacker-reachable network input before authentication completes, a freed-then-reused heap object can be leveraged for control-flow hijack and code execution. The CPE cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* identifies Fireware OS itself as the affected software; exploitability is gated on the presence of the Mobile VPN with IKEv2 feature bound to an LDAP authentication server.

RemediationAI

Patch available per vendor advisory - consult WatchGuard PSIRT advisory WGSA-2026-00023 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023) for the fixed Fireware OS build corresponding to your release line (11.x, 12.x, or 2025.x/2026.x) and upgrade to it; an exact fixed version number is not present in the available data and should be taken from the advisory. If immediate patching is not possible, the most direct compensating control is to reconfigure the Mobile User VPN with IKEv2 to use a non-LDAP authentication method (for example the Firebox-DB local database or a RADIUS server), which removes the vulnerable LDAP code path at the cost of changing your user authentication source. Alternatively, temporarily disable the Mobile VPN with IKEv2 (or restrict the IKEv2/IPsec UDP 500/4500 listener to known management IPs via geo/IP restrictions) to cut off remote reachability, accepting the trade-off of interrupted remote-access VPN service for mobile users. Do not rely on rate-limiting alone, since a race-condition exploit inherently involves repeated connection attempts.