EUVD-2026-67339
GHSA-mv65-j857-xm58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for exposed Firebox IKE service
-
DeliverySend crafted IKE network traffic
-
ExploitTrigger type confusion / OOB read in iked
-
ExecutionExecute arbitrary code on appliance
-
ImpactPivot into protected network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the WatchGuard Firebox to have the IKE/IPsec VPN service (the iked process) enabled and network-reachable by the attacker - this is the concrete prerequisite, as iked must be listening (typically UDP 500/4500) to receive the crafted IKE traffic. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special attack requirement, and no user interaction are needed against an exposed VPN endpoint. The principal limiting factor is deployment: appliances that do not have IPsec/IKE VPN configured or that restrict IKE reachability to trusted peer IPs are not exposed. Specific affected firmware versions were not provided and act as a further scoping condition to verify against the vendor advisory. |
| Impact | The signals are strongly consistent on severity but incomplete on real-world exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes the worst practical class of firewall vulnerability: remote, unauthenticated, low-complexity code execution on a perimeter device, scoring 9.3. There is no EPSS score, no CISA KEV listing, and no POC referenced, so exploitation probability is unquantified - this appears to be a vendor-coordinated disclosure ahead of observed attacks rather than an actively-exploited zero-day. Two caveats temper certainty: (1) the CWE (out-of-bounds READ) and the 'Information Disclosure' tag suggest the primary primitive may be memory disclosure, yet the description and VI/VA:H claim full RCE - a memory read that enables code execution is plausible (info leak defeating ASLR chained to a write) but the RCE claim should be confirmed against the WatchGuard PSIRT advisory; (2) the CVSS 3.1 equivalent is not provided. Given the target class (internet-facing VPN concentrator), historical attacker interest in firewall IKE daemons, and pre-auth reachability, this warrants emergency-patch prioritization despite the absence of an EPSS/KEV signal. |
| Exploit ScenarioDerived | An attacker scans the internet for WatchGuard Firebox appliances exposing the IKE/IPsec VPN service on UDP 500/4500, then sends a crafted IKE message that triggers the type-confusion/out-of-bounds condition in the iked process. Because no authentication or user interaction is required (PR:N/UI:N/AC:L), a single malformed packet stream can crash the daemon or, if the RCE claim holds, execute attacker code on the firewall, yielding a pivot into the internal network. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.
RemediationAI
Apply the WatchGuard Fireware OS update identified in the vendor advisory at https://psirt.watchguard.com/CVE-2026-19315 as the primary fix; no exact fixed version number was included in the input data, so obtain the precise patched build from that advisory before deployment (no vendor-released patch version is independently confirmed here). As an interim compensating control, restrict or disable the IKE/IPsec VPN service on the affected Firebox where feasible, or limit inbound UDP 500/4500 (and IKE) exposure to known peer IP addresses via firewall policy - this blocks the attack surface but will break mobile/roaming VPN clients and any dynamic-IP site-to-site tunnels, so scope it to devices where VPN termination can tolerate the restriction. Where the VPN must remain open, prioritize patching over the workaround and monitor iked/VPN logs for crashes or malformed IKE negotiation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fireware OS is the firmware powering WatchGuard Firebox network security appliances. The affected component, iked, is the IKE (Internet Key Exchange) daemon that negotiates IPsec VPN tunnels - a service that by design listens on the untrusted/WAN interface (typically UDP 500/4500) to establish site-to-site and mobile VPN sessions, making it reachable pre-authentication. The assigned root cause is CWE-125 (Out-of-bounds Read), while the description characterizes the flaw as a type confusion; both classes stem from the daemon mishandling attacker-controlled IKE message structures during parsing, allowing memory to be read or interpreted incorrectly. The CPE identifies cpe:2.3:a:watchguard:fireware_os across all versions (wildcard), so exact affected builds must be taken from the vendor advisory rather than the CPE alone.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Pre-auth, network-reachable IKE daemon with no user interaction gives AV:N/AC:L/PR:N/UI:N; described RCE justifies C/I/A:H with scope unchanged on the affected OS.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Executive ViewAI
WatchGuard Fireware OS contains a critical remote code execution vulnerability in its VPN daemon that permits unauthenticated, network-based exploitation from the internet with no patch currently available. This directly threatens the security posture of organizations' perimeter defenses, potentially allowing attackers to bypass firewall protections and establish network access. Immediate compensating controls are essential given the absence of vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to VPN listeners via upstream firewalls or access control lists, limiting exposure to authorized sources only; implement network segmentation to isolate affected appliances and limit lateral movement if compromised; deploy enhanced monitoring for VPN authentication anomalies and failed access attempts; consider temporary disabling of remote VPN access if operationally feasible pending patch release; monitor WatchGuard security advisories for manufacturer-recommended temporary workarounds; establish emergency change control procedures for immediate patching deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB