EUVD-2026-67337
GHSA-fj8p-qfhx-jffx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WatchGuard appliance IKE listener on UDP 500/4500
-
DeliveryCraft malformed IKE negotiation packet with out-of-bounds payload
-
ExploitSend packet to iked process unauthenticated
-
ExecutionTrigger OOB read causing iked process crash
-
ImpactVPN service unavailable, all tunnels dropped
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability to the iked VPN listener: exploitation is unauthenticated, requires no prior session state, and targets the default IKE service (UDP 500/4500) that must be externally reachable for any IPsec VPN to function. Limiting factors include: the appliance must have the iked process running and the VPN listener exposed on a reachable interface, and exploitation results only in a DoS (availability) impact - there is no confirmed code execution or confidentiality breach from this flaw alone. Organizations that do not use WatchGuard IPsec VPN or have the iked listener blocked from untrusted networks are not exposed. |
| Impact | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N reflects a network-accessible, low-complexity, unauthenticated DoS with high availability impact on the vulnerable component and no scope change. The signals are largely consistent: no elevated privileges, no user interaction, and direct network reachability to the iked VPN listener. The risk is high for organizations relying on WatchGuard IPsec VPNs - a successful exploit disrupts VPN connectivity entirely, which is operationally severe for remote-access or site-to-site deployments. No EPSS data was provided in the source intelligence. No CISA KEV listing exists, and no public exploit code has been identified, which moderates near-term mass exploitation probability. However, the zero-prerequisite attack profile (unauthenticated, network, low complexity) means exploitation is straightforward once a PoC is developed. The 'Information Disclosure' tag warrants attention: CWE-125 OOB reads can leak heap or stack memory in addition to crashing, but CVSS explicitly sets VC:N - this discrepancy should be verified against the full WatchGuard advisory at https://psirt.watchguard.com/CVE-2026-19317. |
| Exploit ScenarioDerived | An attacker with network access to the WatchGuard appliance's IKE listener sends a single malformed IKE negotiation packet containing a crafted payload that triggers an out-of-bounds read in the iked process, causing it to crash and terminating all active and pending VPN sessions. No authentication or prior session state is required, and the low complexity means the attack can be scripted and sent repeatedly to maintain a persistent DoS condition. No public PoC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.
RemediationAI
The primary remediation is to apply the vendor-released patch from WatchGuard once available; consult the PSIRT advisory at https://psirt.watchguard.com/CVE-2026-19317 for exact patched version numbers, as none were specified in the available intelligence. Until patching is complete, restrict inbound IKE traffic (UDP 500 and UDP 4500, used for IKE and NAT-T respectively) to known trusted IP addresses or VPN peers using upstream firewall rules or WatchGuard policy - this directly limits the attacker's ability to reach the iked listener. If the VPN service is not required on the exposed interface, disable the iked service or the relevant VPN configuration profiles to eliminate the attack surface entirely; note this disrupts all IPsec VPN tunnels on the affected interface. For perimeter-deployed appliances where IKE cannot be filtered, consider temporarily routing VPN traffic through an intermediate gateway that can validate IKE packet structure before forwarding. Monitor iked process health and restart policies, as crashes will interrupt VPN availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The iked process in WatchGuard Fireware OS implements the IKE (Internet Key Exchange) protocol used for IPsec VPN tunnel negotiation. CWE-125 (Out-of-Bounds Read) indicates the process reads beyond the bounds of an allocated buffer when parsing incoming IKE/VPN traffic, likely during packet parsing or payload processing. This class of flaw in network-facing daemons typically results from insufficient length validation of attacker-controlled fields before dereferencing a pointer or indexing into a buffer. The affected CPE (cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*) uses a wildcard version, indicating no specific version range has been bounded - meaning all Fireware OS releases should be treated as potentially affected until the vendor advisory specifies otherwise. Tags include 'Information Disclosure,' consistent with OOB reads potentially leaking adjacent memory contents, though the CVSS 4.0 vector explicitly shows VC:N, suggesting confirmed confidentiality impact has not been demonstrated.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable unauthenticated IKE listener crash; pure availability impact, no scope change, no confidentiality or integrity effect confirmed.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Executive ViewAI
A critical vulnerability in WatchGuard Fireware OS iked daemon allows unauthenticated remote attackers to crash VPN services with no public exploit identified at time of analysis, though low attack complexity makes exploitation a realistic risk. All Fireware OS versions are affected, with no vendor patch currently available, creating immediate business continuity risk for organizations dependent on WatchGuard VPN appliances. This directly threatens workforce connectivity and remote access-foundational enterprise capabilities-requiring urgent mitigation action.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation restricting iked listener access to trusted networks only; (2) Rate-limiting and traffic filtering rules on iked ports to block suspicious patterns; (3) Redundant VPN appliances with automatic failover to maintain availability during attacks; (4) Real-time monitoring and alerting for iked process crashes and anomalous traffic patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB