EUVD-2026-67332
GHSA-r6p9-hmgr-2w5p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or complexity; impact is pure availability loss on the vulnerable system with no scope change, confidentiality, or integrity effect.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
AnalysisAI
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required beyond the iked service being active - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation with no attack prerequisites against any Fireware OS appliance with IKE/IPsec VPN enabled, which is the default and primary use case for WatchGuard appliances. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 is well-supported by the attack profile: the vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects a network-reachable, zero-prerequisite exploit with a high availability impact confined to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-supplied patch as documented in the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-19316 - no specific fixed version number is independently confirmable from the available input data, so the advisory must be consulted directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all internet-exposed WatchGuard Fireware devices with IPsec VPN enabled and document their criticality to business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allo
Same weakness CWE-415 – Double Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today