Three WatchGuard Firebox Bugs Could Turn a VPN Handshake Into Remote Code Execution
Three critical flaws in the VPN handshake code of WatchGuard Firebox appliances can let an unauthenticated attacker turn specially crafted network traffic into remote code execution. The vulnerable component is the IKE daemon, the process that handles internet-facing VPN negotiations before a user has logged in.
The most serious issues are CVE-2026-19313, CVE-2026-19315 and CVE-2026-19318. Each carries a critical 9.3 CVSS v4 score and requires no credentials or user interaction. WatchGuard says it has not seen evidence of exploitation, but it is urging customers and managed service providers to update every owned, managed and client-operated Firebox immediately.
The VPN gateway is the vulnerable service
Firewalls and VPN appliances are attractive targets because they sit at the network edge and are expected to accept traffic from untrusted systems. A pre-authentication flaw in the IKE daemon removes the protection that a strong VPN password or multifactor authentication would normally provide. The malicious packet reaches vulnerable code before identity controls can help.
Two of the critical bugs are conventional memory corruption. CVE-2026-19313 is a heap buffer overflow, while CVE-2026-19318 is a stack-based buffer overflow. Both allow a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
CVE-2026-19315 is a type confusion flaw triggered by an IKE_AUTH message containing two EAP payloads. WatchGuard says the resulting out-of-bounds read and free operation can use an attacker-influenced pointer. A failed attempt can crash and restart the daemon, but the memory corruption creates a path to remote code execution.
The bulletin contains eleven separate Fireware flaws
WatchGuard’s 27 August notice lists eleven Fireware vulnerabilities. The vendor’s blog contains a typographical error, writing one identifier as CVE-2026-193114. The PSIRT catalogue confirms that the correct identifier is CVE-2026-19314.
| Vulnerability | Impact and prerequisites | Severity |
|---|---|---|
| CVE-2026-13086 | Stack buffer overflow in the deprecated Mobile Security epm endpoint. A network-adjacent attacker with access to a trusted interface can send JSON-RPC traffic and execute code as root without authentication. | Critical, 9.3 |
| CVE-2026-19313 | Pre-authentication heap buffer overflow in iked. Specially crafted network traffic can lead to remote code execution. | Critical, 9.3 |
| CVE-2026-19314 | Unauthenticated integer underflow in iked. Crafted traffic can disrupt VPN processing and cause denial of service. | High, 8.7 |
| CVE-2026-19315 | Pre-authentication type confusion in iked. Two EAP payloads can corrupt memory, crash the daemon and create remote code execution potential. | Critical, 9.3 |
| CVE-2026-19316 | Pre-authentication double free in iked. A single crafted UDP packet can crash and respawn the process, interrupting VPN service. | High, 8.7 |
| CVE-2026-19317 | Pre-authentication out-of-bounds read in iked. Unauthenticated traffic can cause denial of service. | High, 8.7 |
| CVE-2026-19318 | Pre-authentication stack buffer overflow in iked. Specially crafted network traffic can lead to remote code execution. | Critical, 9.3 |
| CVE-2026-78008 | Authenticated buffer overflow in wgagent. Exploitation requires valid access to the affected management path. | High, 8.6 |
| CVE-2026-78009 | Out-of-bounds read in iked. Unauthenticated crafted traffic can interrupt VPN service. | High, 8.7 |
| CVE-2026-78010 | Stack-based buffer overflow in iked. WatchGuard classifies the demonstrated impact as unauthenticated denial of service. | High, 8.7 |
| CVE-2026-78011 | Integer underflow in iked. Unauthenticated crafted traffic can cause denial of service. | High, 8.7 |
All eleven issues affect default Fireware releases from 2025.0 up to, but not including, 2026.2.2 and the 12.x branch from 12.0 up to, but not including, 12.12.2. T15 and T35 appliances running the legacy branch are affected from version 12.0 up to, but not including, 12.5.20.
The fix is a firmware update, not a VPN policy change
WatchGuard has released Fireware 2026.2.2, 12.12.2 and 12.5.20. Administrators should install the branch appropriate to each appliance or a newer supported release. The vendor does not provide a general workaround for the affected IKE processing code.
Disabling an unused VPN service can reduce exposure, but it should not be treated as a substitute for updating. Managed service providers should also check customer appliances that are online but missing from normal inventory or patch dashboards. An internet-facing firewall forgotten by central management is still internet-facing.
No exploitation has been confirmed, but the boundary failure is serious
WatchGuard says it is not aware of exploitation in the wild. The three remote code execution vulnerabilities were not in CISA’s Known Exploited Vulnerabilities catalogue at the time of writing, and the reviewed sources did not identify public exploit code. Those facts should be reported clearly, but they should not be mistaken for evidence that exposed appliances are safe.
Several flaws were reported by McCaulay Hudson of watchTowr, with the Mobile Security issue credited to Mat Powell of TrendAI’s Zero Day Initiative. That independent research pedigree, combined with detailed vendor advisories and low-complexity network attack vectors, gives defenders enough information to treat the release as an urgent edge-device update.
What defenders should do
- Inventory every Firebox, including high-availability peers, branch appliances, customer-managed devices and standby units.
- Upgrade to Fireware 2026.2.2, 12.12.2 or 12.5.20 as applicable.
- Confirm the running version after reboot instead of relying only on a successful deployment status.
- Review IKE and VPN daemon logs for unusual crashes, repeated respawns or malformed negotiation traffic.
- Check management systems for appliances that stopped reporting before the update campaign.
- Restrict trusted-interface access to the deprecated Mobile Security epm service and retire the feature where it is no longer required.
- Keep incident-response plans ready for replacement or clean rebuild if an exposed appliance shows unexplained configuration changes.
The uncomfortable lesson is that the VPN handshake itself can be the attack surface. When a perimeter appliance processes hostile traffic before authentication, identity controls protect the session only after the vulnerable code has already run.
Sources
- WatchGuard, Immediate Action Required: Update Your Firebox Now, published 27 August 2026. No publication time was provided.
- WatchGuard PSIRT advisory catalogue, individual advisories published and updated 27 August 2026. No publication times were provided.
- WatchGuard advisory for the iked heap buffer overflow, published 27 August 2026.
- WatchGuard advisory for the iked type confusion flaw, published 27 August 2026.
- WatchGuard advisory for the iked stack buffer overflow, published 27 August 2026.
