EUVD-2026-67330
GHSA-hj2q-w426-x635
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate internet-facing Firebox with IKE open
-
DeliverySend crafted IKE packet to iked
-
ExploitOverflow stack buffer in parser
-
ExecutionHijack control flow, execute code
-
ImpactCompromise firewall perimeter
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected Firebox must expose the iked (IKE/IPsec VPN key-exchange) service to the attacker - i.e., an IPsec VPN feature (Mobile VPN with IPsec or branch-office IPsec) is enabled and UDP 500/4500 is reachable from the attacker's network position. Given the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, exploitation is remote and unauthenticated against such configurations with no user interaction. The primary limiting factor is whether IPsec/IKE is enabled and internet-reachable: appliances with IPsec disabled or with UDP 500/4500 filtered to known peers are not exposed on this path. Exact vulnerable Fireware OS versions are not specified in the input and must be confirmed from the vendor advisory. |
| Impact | This rates as a genuine high priority, not an inflated CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full compromise of the appliance - the worst-case profile for an edge device. Signals are partly incomplete: EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so current exploitation appears to be no-public-exploit rather than active - but absence of a POC does not lower the intrinsic severity of a pre-auth RCE on a firewall, and such devices are historically high-value targets that attract exploit development quickly once patched details circulate. The impact lands on the security perimeter itself, so any organization running an internet-facing Firebox with IPsec/IKE enabled should treat this as urgent regardless of size. The main uncertainty is scope of affected versions, which the CPE leaves open; verify exact version boundaries against the WatchGuard PSIRT advisory before concluding you are unaffected. |
| Exploit ScenarioDerived | An attacker scans the internet for Fireboxes exposing IKE on UDP 500/4500 and sends a crafted IKE message whose oversized field overflows a stack buffer in iked, overwriting the return address to hijack execution. Given AV:N/AC:L/PR:N, this requires only network reachability and no credentials or user interaction, yielding code execution on the firewall and a foothold at the network perimeter. No public exploit is identified at time of analysis, so this scenario is derived from the vulnerability class and CVSS vector rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
RemediationAI
Apply the fixed Fireware OS release identified in the WatchGuard PSIRT advisory (https://psirt.watchguard.com/CVE-2026-19318) - patch available per vendor advisory; an exact fixed version is not included in the provided data, so confirm the target build directly from that advisory rather than assuming one. As an immediate compensating control until patched, restrict who can reach the IKE service: limit inbound UDP 500 and 4500 on the affected Firebox to known VPN peer IP addresses via firewall policy, which blocks the unauthenticated attack surface for site-to-site tunnels but will break mobile/roaming VPN clients that connect from arbitrary addresses. Where IPsec VPN is not used, disable the Mobile VPN with IPsec and branch-office IPsec features to remove the vulnerable daemon exposure entirely, accepting the loss of IPsec tunnel functionality. Monitor iked for crashes or restarts as a possible exploitation indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fireware OS is the firmware that runs WatchGuard Firebox firewall/UTM appliances. The affected component, iked, is the Internet Key Exchange daemon that negotiates IPsec VPN tunnels (IKEv1/IKEv2 over UDP 500/4500). The root cause is CWE-121, a stack-based buffer overflow: attacker-controlled data from an IKE message is copied into a fixed-size stack buffer without adequate bounds checking, overwriting the return address or adjacent stack state and enabling control-flow hijack. Because IKE processing happens before any VPN authentication completes, the vulnerable parsing path is exposed to unauthenticated peers. The CPE data identifies the affected product as cpe:2.3:a:watchguard:fireware_os with the version left unbounded (*), so exact fixed/affected boundaries must come from the vendor advisory.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated IKE parsing reached before VPN auth gives AV:N/AC:L/PR:N/UI:N; memory-corruption RCE on the appliance yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Executive ViewAI
WatchGuard Fireware OS contains a pre-authentication remote code execution vulnerability in its IKE/IPsec VPN daemon that allows attackers without credentials to execute arbitrary code on Firebox appliances. This critical vulnerability threatens all perimeter security devices running affected versions, potentially enabling attackers to bypass network defenses, intercept encrypted traffic, and establish persistence for lateral movement into internal networks.
No vendor-released patch identified at time of analysis. Interim mitigations include: network access control restricting IKE/IPsec to trusted subnets; disabling IKE/IPsec on appliances where VPN services are not required; IDS/IPS signature deployment to detect malformed IKE packets and exploitation patterns; enhanced logging and alerting for IKE daemon errors and unusual restarts; out-of-band appliance monitoring to detect unauthorized code execution; and preparation of rapid patching procedures for immediate deployment when vendor patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB