WatchGuard Fireware OS CVE-2026-78009

No authentication is required and no special configuration is needed beyond the appliance having IKE-based VPN functionality enabled, which is the standard operational mode for WatchGuard Firebox devices. The attacker requires network reachability to the WatchGuard appliance on UDP port 500 (IKE) or UDP port 4500 (NAT-T IKE), which are necessarily exposed when VPN services are active. Exploitation is limited by: (1) network segmentation or firewall rules restricting IKE traffic from untrusted sources; (2) no version-specific condition is confirmed, but the impact is scoped to the iked service - the underlying OS and other services remain unaffected unless a process restart creates secondary disruption. There is no user interaction required and no authentication barrier.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a straightforward unauthenticated network-exploitable flaw requiring no special conditions, which represents genuine operational risk for any deployment exposing IKE/UDP 500 or 4500 to untrusted networks. However, a critical inconsistency exists in the provided vector: VC:H is set (implying high confidentiality impact) while VA:N is set (no availability impact), directly contradicting the description which states the primary impact is a Denial of Service condition. This miscalibration warrants verification with the WatchGuard PSIRT advisory before using the published vector for prioritization. EPSS data was not supplied, so exploitation probability cannot be compared against the CVSS score. KEV status is not confirmed, meaning active in-the-wild exploitation is not established. No public proof-of-concept is known at time of analysis. Real-world priority is high for organizations using WatchGuard VPN infrastructure, because the iked service is internet-facing by design, unauthenticated exploitation requires only network reachability, and VPN disruption can constitute a significant operational or security incident - but the absence of KEV and POC data moderates urgency relative to actively exploited network appliance flaws.

An external attacker who can send UDP packets to the WatchGuard appliance's IKE port (UDP 500 or 4500) crafts an IKE initiation message with malformed payload length fields or invalid attributes, causing the iked parser to perform an out-of-bounds read. The resulting memory access violation crashes the iked process, dropping all active VPN tunnels and preventing new IKE negotiations until the service recovers or is manually restarted. No public proof-of-concept code is known, but the attack requires only basic IKE protocol knowledge and network reachability to the appliance.