WatchGuard Fireware: 10 iked and epm flaws, four scored 9.3

WatchGuard has released fixes for ten Fireware OS vulnerabilities, most of them in the IKE daemon. CVE-2026-19313, CVE-2026-19315 and CVE-2026-19318 describe pre-authentication memory-safety flaws with potential for remote code execution, while CVE-2026-13086 is a critical stack overflow in the epm service used by the deprecated Mobile Security feature. Each of these four records has a CVSS 4.0 score of 9.3 (Critical).

The remaining six—CVE-2026-19314, CVE-2026-19316, CVE-2026-19317, CVE-2026-78009, CVE-2026-78010 and CVE-2026-78011—score 8.7 (High) and cover integer underflow, double free, out-of-bounds reads and overflows whose confirmed result is primarily loss of VPN service. Some mechanisms may have greater impact under a favourable memory layout, but the vendor does not confirm RCE for every issue.

WatchGuard published the advisories on 27 August, and NVD indexed the records after midnight on 28 August. WatchGuard says it is not aware of exploitation in the wild for any of them. The absence of confirmed exploitation does not lower the priority of an edge appliance serving remote access.

One remediation target

All ten records identify the same fixed releases:

Fireware OS 2026.2.2 or later for the current train;
Fireware OS 12.12.2 or later for the 12.x train;
Fireware OS 12.5.20 or later for T15 and T35 models.

Default platforms are affected from 2025.0 up to but excluding 2026.2.2 and from 12.0 up to but excluding 12.12.2. The T15/T35 range starts at 12.0 and ends before 12.5.20. Administrators must check both the model and maintenance train rather than relying on the leading version digits.

CVE-2026-19313: a pre-authentication heap overflow

The iked daemon handles IKE negotiation for VPN services. CVE-2026-19313 is a remotely triggerable heap buffer overflow requiring no authentication. WatchGuard confirms a crash and attacker-controlled data written beyond an allocation, creating potential for remote code execution.

A publicly reachable IKE service on UDP 500 or 4500 is normal for a VPN, so a firewall is not safe merely because its web interface is absent from the internet. Assess the exact exposure policy, NAT behaviour and interfaces on which the daemon accepts negotiation.

CVE-2026-19315: type confusion with two EAP payloads

This flaw arises when an IKE_AUTH message contains two EAP payloads. The wrong type leads to an out-of-bounds read and then free() on a pointer influenced by the attacker. Confirmed impact is termination and restart of iked; WatchGuard also identifies possible further memory corruption and RCE.

Type confusion cannot be eliminated simply by filtering packet length. A parser must enforce the permitted sequence and cardinality of protocol objects, negotiation state and the type handed to downstream functions. The defence requires corrected code rather than a basic size limit on the firewall.

CVE-2026-19318: a stack overflow dependent on diagnostic logging

CVE-2026-19318 concerns an IKE_AUTH message carrying EAP-MSCHAPv2 with an undersized embedded length. It causes a stack overflow that can terminate the daemon and may permit code execution. One significant prerequisite is that IKE payload diagnostic logging is enabled.

This is a supported troubleshooting option and may remain active after a VPN incident. Inventory must therefore include diagnostic configuration as well as versions. Disabling that logging reduces this particular path until the update, but it does not remediate the other nine CVEs.

CVE-2026-13086: a deprecated Mobile Security feature remains attack surface

The Endpoint Protection Manager (epm) service associated with deprecated Mobile Security has a stack overflow in JSON-RPC processing. A network-adjacent attacker on a trusted interface can overwrite the return address without authentication and execute code as root. The advisory notes the absence of a stack canary and a non-PIE binary, which reduce exploitation barriers.

This is a trusted-interface path, not automatically an internet path. Its importance rises after compromise of a LAN host, incorrect management routing or flat segmentation. Disable the deprecated module when it is no longer used, but patching remains the correct remediation for the appliance.

Six High-severity flaws

CVE-2026-19314 is an integer underflow that can lead to overflow and denial of service. WatchGuard notes that an internal test against a fixed build with a reconstructed proof of concept did not reproduce a crash; the record remains part of the corrected scope.

CVE-2026-19316 is a double-free/use-after-free condition triggerable by one UDP packet. Crash and respawn are confirmed, while attacker control over payload order and content may increase heap-corruption risk. The vendor does not claim confirmed RCE.

CVE-2026-19317 lets an unauthenticated remote party cause an out-of-bounds read and segmentation fault. Impact covers IPsec services including Mobile User VPN and Branch Office VPN using IKEv2.

CVE-2026-78009 requires completion of an IKEv2 SA_INIT exchange. A malformed encrypted INFORMATIONAL message containing a DELETE payload then causes a large out-of-bounds heap read. Denial of service is confirmed, and the advisory identifies potential disclosure of neighbouring memory under a favourable layout.

CVE-2026-78010 has a different access requirement: an authenticated IKEv2 peer with valid credentials and an established Child SA. The stack overflow restarts the process. Overwritten values are primarily server-controlled, so WatchGuard considers RCE unlikely.

CVE-2026-78011 is an integer underflow in IKEv1 handling. One crafted packet can cause an uncontrolled write and crash. Denial of service is confirmed, while the vendor does not exclude a code-execution path depending on memory layout.

Why daemon respawn does not remove the risk

Automatic respawn restores the process, but active and new tunnels can fail during each crash. Replayed traffic can maintain an outage despite each individual restart being brief. For branches, remote workers and data-centre interconnects, this is loss of a business route, not merely a log entry.

A crash may also indicate a failed attempt against a critical vulnerability. Treating every restart as a stability bug discards incident context. Preserve logs, core dumps, image version and traffic metadata before completing recovery work.

What Firebox administrators should do

Identify the exact model, Fireware version, HA mode and enabled IKE or Mobile Security services. Inspect both HA members; a standby running an affected image may return to service during failover. Obtain the correct release from the official channel and verify image integrity under the vendor procedure.

Before upgrading, preserve configuration and document tunnel state, routing, policies, certificates and subscriptions. Plan an outage or failover, then validate representative IKEv1 and IKEv2 tunnels, Mobile User VPN, Branch Office VPN, NAT-T and EAP authentication after installation.

If the update must wait, disable unused Mobile Security and IKE payload diagnostic logging, restrict trusted interfaces and narrow VPN sources where the business model permits. Do not block UDP 500/4500 without coordination when they are the production access path. Mitigations are CVE-specific and do not replace fixed firmware.

Detection and triage

Monitor iked and epm restarts, core dumps, segmentation faults, SIGABRT, negotiation-error spikes and bursts of tunnel re-establishment. Correlate them with source address, ingress interface, IKE version and exchange stage. Unusual repetitions of EAP, DELETE or INFORMATIONAL messages warrant analysis, but one payload signature should not be the sole control.

For CVE-2026-13086, review access to epm from networks whose users or devices should not administer the Firebox. For CVE-2026-19318, inspect diagnostic-setting history. Logging being disabled today does not prove the path was unreachable during earlier crashes.

If RCE is suspected, extend analysis beyond the VPN process. Validate administrator accounts, configuration, tasks, certificates, routing rules and outbound traffic. An edge device can become a durable access point, so a clean restart does not restore trust.

Primary facts and Breachroad conclusions

Identifiers, scores, prerequisites, version ranges, fixed releases and the statement of no known exploitation come from individual WatchGuard PSIRT pages and CVE records. Monitoring priorities, HA test planning and evidence-preservation guidance are Breachroad’s defensive conclusions. We preserve “potential RCE” as a vendor-identified possibility rather than presenting it as a confirmed result for CVEs primarily rated for denial of service.

Primary sources

Securing edge devices requires patching, segmentation and trustworthy telemetry together. Our organisational cybersecurity training teaches teams to triage vulnerabilities and respond when a crash may be an attack attempt. Infrastructure and application penetration testing can cover VPN exposure, segmentation and management surfaces within an agreed scope.