WatchGuard Fireware OS CVE-2026-19313

The affected iked process must be reachable, which in practice means the Firebox has IPsec/IKE VPN services enabled and exposed on the attacker's network path (typically internet-facing UDP/500 and UDP/4500). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed - exploitation works against a reachable, VPN-enabled device via crafted network traffic. The primary limiting factor is exposure of the IKE service: appliances with IPsec VPN disabled, or with UDP/500 and UDP/4500 filtered to trusted peers only, are not remotely reachable for this attack. Exact vulnerable firmware versions are unconfirmed in the provided data, so version applicability is a further gating condition to verify against the vendor advisory.

The signals converge on genuine high priority rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated, no-interaction exploitation, and the VC:H/VI:H/VA:H impact block reflects full device compromise, consistent with RCE on a firewall. Countervailing signals lower immediate urgency: the CVE is NOT in CISA KEV, no POC or exploit code is referenced, and no EPSS score was provided, so there is no evidence yet of active or mass exploitation. Residual risk is driven by the target class - internet-facing VPN/firewall pre-auth RCE is a historically favored target for both APT and ransomware actors - while heap overflows in IKE daemons are exploitable but non-trivial, so weaponization may lag disclosure. EPSS is missing so exploitation probability cannot be quantified; treat likelihood as moderate and rising, and patch proactively rather than waiting for a KEV addition.

An attacker locates an internet-facing WatchGuard Firebox with IPsec VPN enabled and sends a crafted IKE negotiation packet to UDP/500 or UDP/4500, triggering the heap overflow in iked before any authentication occurs. By shaping the malformed payload to corrupt heap structures, the attacker gains code execution on the firewall, establishing a foothold at the perimeter from which to pivot into internal networks. No public exploit is identified at time of analysis; the low attack complexity (AC:L) means reliable exploitation would be straightforward once a working technique exists.