CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2026-13368

CVSS 9.2v4.0pub. 2026-07-03upd. 2026-08-28

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.

🤖 AI Analysis
How it works

The vulnerability is triggered by a race condition in the code handling LDAP authentication during IKEv2 connection negotiation. Due to thread racing, a use-after-free condition occurs (CWE-416), where the iked process references a memory area that has already been freed. An attacker can craft appropriate network traffic directed at the IKEv2 VPN interface to trigger this anomaly and gain control of code execution in the context of the iked process. A necessary condition is configuring Mobile VPN with IKEv2 to use an external LDAP authentication server.

Impact

An attacker can execute arbitrary code (RCE) in the context of the iked process on the Firebox device, which may lead to complete takeover of the VPN process, disclosure of sensitive authentication credentials, or further compromise of network infrastructure.

Mitigation & patch

Patches available from the vendor should be applied according to the references (advisory WGSA-2026-00023 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023). Until an update is applied, it is recommended to disable Mobile VPN with IKEv2 or change the authentication method from external LDAP to another method, if operationally feasible.

Who is affected

WatchGuard Fireware OS in versions: 11.0 to 11.12.4_Update1 inclusive, 12.0 to 12.12 inclusive, and 2025.1 to 2026.2 inclusive — on Firebox devices with active Mobile VPN with IKEv2 configuration and external LDAP server

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Watchguard Firebox Cloud

    APP
    Watchguard
    all versions

  • Watchguard Firebox M270

    HW
    Watchguard
    all versions

  • Watchguard Firebox M290

    HW
    Watchguard
    all versions

  • Watchguard Firebox M295

    HW
    Watchguard
    all versions

  • Watchguard Firebox M370

    HW
    Watchguard
    all versions

  • Watchguard Firebox M390

    HW
    Watchguard
    all versions

  • Watchguard Firebox M395

    HW
    Watchguard
    all versions

  • Watchguard Firebox M440

    HW
    Watchguard
    all versions

  • Watchguard Firebox M4600

    HW
    Watchguard
    all versions

  • Watchguard Firebox M470

    HW
    Watchguard
    all versions

  • Watchguard Firebox M4800

    HW
    Watchguard
    all versions

  • Watchguard Firebox M495

    HW
    Watchguard
    all versions

  • Watchguard Firebox M5600

    HW
    Watchguard
    all versions

  • Watchguard Firebox M570

    HW
    Watchguard
    all versions

  • Watchguard Firebox M5800

    HW
    Watchguard
    all versions

  • Watchguard Firebox M590

    HW
    Watchguard
    all versions

  • Watchguard Firebox M595

    HW
    Watchguard
    all versions

  • Watchguard Firebox M670

    HW
    Watchguard
    all versions

  • Watchguard Firebox M690

    HW
    Watchguard
    all versions

  • Watchguard Firebox M695

    HW
    Watchguard
    all versions

  • Watchguard Firebox Nv5

    HW
    Watchguard
    all versions

  • Watchguard Firebox T115 W

    HW
    Watchguard
    all versions

  • Watchguard Firebox T125

    HW
    Watchguard
    all versions

  • Watchguard Firebox T125 W

    HW
    Watchguard
    all versions

  • Watchguard Firebox T145

    HW
    Watchguard
    all versions

  • Watchguard Firebox T145 W

    HW
    Watchguard
    all versions

  • Watchguard Firebox T15

    HW
    Watchguard
    all versions

  • Watchguard Firebox T185

    HW
    Watchguard
    all versions

  • Watchguard Firebox T20

    HW
    Watchguard
    all versions

  • Watchguard Firebox T25

    HW
    Watchguard
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEAuth BypassRace ConditionVPNMemory
CWE
References

Related vulnerabilities

CVE-2025-14733CRITICAL9.3⚠ KEVsame product

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthentic...

CVE-2025-9242CRITICAL9.3⚠ KEVsame product

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthentic...

CVE-2022-26318CRITICAL9.8⚠ KEVPL ✓same product

RCE bez uwierzytelnienia w WatchGuard Firebox i XTM (FBX-22786)

CVE-2022-31789CRITICAL9.8PL ✓same product

Integer overflow w WatchGuard Firebox/XTM umożliwiający RCE bez uwierzytelnienia

CVE-2022-25361CRITICAL9.1PL ✓same product

WatchGuard Firebox/XTM – zdalne usuwanie plików bez uwierzytelnienia