CVE-2026-13368
Full vulnerability record from the local CVENow database.
Description
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.
Severity
CRITICAL
CVSS score
9.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
5d1c2695-1a31-4499-88ae-e847036fd7e3
Published
2026-07-03 00:16:50.890000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-13368",
"sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"published": "2026-07-03T00:16:50.890",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server."
},
{
"lang": "es",
"value": "WatchGuard Fireware OS contiene una condición de carrera que conduce a una vulnerabilidad de uso después de liberación en la autenticación LDAP para la VPN de usuario móvil con IKEv2. Un atacante remoto no autenticado podría explotar esta vulnerabilidad para ejecutar código arbitrario en el contexto del proceso iked en Fireboxes que tienen una VPN móvil con IKEv2 configurada para usar un servidor de autenticación LDAP externo.\n\nEsta vulnerabilidad afecta a Fireware OS 11.0 hasta e incluyendo 11.12.4_Update1, 12.0 hasta e incluyendo 12.12 y 2025.1 hasta e incluyendo 2026.2."
}
],
"affected": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"affectedData": [
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"Default"
],
"versions": [
{
"version": "2025.1",
"lessThan": "2026.2.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0",
"lessThan": "12.12.1",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "11.10.2",
"lessThanOrEqual": "11.12.4+541730",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"EUCC"
],
"versions": [
{
"version": "12.0",
"lessThan": "12.11.9",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"T15/T35"
],
"versions": [
{
"version": "12.0",
"lessThan": "12.5.19",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T00:00:00+00:00",
"id": "CVE-2026-13368",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1",
"versionEndExcluding": "2026.2.1",
"matchCriteriaId": "51B8E788-8FAF-4681-9750-488B2691F473"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*",
"matchCriteriaId": "615FF2CF-69DA-4890-9236-52D8D6FA0E71"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3439409-2FD6-447B-91CF-17D1C09E2A79"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*",
"matchCriteriaId": "575CC5EE-0278-489B-AA95-5EC5058D6FB9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5597F672-3C72-4BCF-AD3F-F16B6913EC2F"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8AAE66B-DD19-4C90-8DFC-F77BA1541642"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FC18430-C6B4-4395-BFF1-83BB005875BA"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A7C1C91-8B6E-4FB0-841E-7F88B06B1435"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE309D6-BD5E-4D18-91C3-A492C3576115"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "75959D39-0960-4836-96C7-DB8048DDE4B8"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D0087049-27C6-4B18-A645-72A8F63D7C6D"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.5",
"versionEndExcluding": "12.5.19",
"matchCriteriaId": "1516BDB6-FE26-4A40-A3C9-87ED9687F396"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "626220F8-7F0C-4DD8-8001-12EA0A777A0D"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E561A57F-91A5-4B3C-9F7D-62E9AB5163A7"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.0.0",
"versionEndExcluding": "11.12.4",
"matchCriteriaId": "506084FE-449B-4C08-B118-7537D3A135E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:11.12.4:-:*:*:*:*:*:*",
"matchCriteriaId": "AEA2B91B-8C5E-445D-97A6-314936B00349"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:11.12.4:u1:*:*:*:*:*:*",
"matchCriteriaId": "3F4679A8-CFA1-4D0B-B08D-90835D8EECA9"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.0",
"versionEndExcluding": "12.12.1",
"matchCriteriaId": "9FEF8DD4-1432-4109-967A-B03188988266"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:a:watchguard:firebox_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BD0A5008-C4F7-434B-8C10-AEB5B1F9E071"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E472917E-D6E1-4C2D-B37D-E76FCC7307CA"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9A8C7779-4466-4A9E-B191-929E7746DFF7"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE9A123-B769-4E56-845E-DC3DA6166C78"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "180FAE8C-2E73-4C09-AA11-0C82A7715FA3"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:*",
"matchCriteriaId": "309DBEF2-1D92-4641-827F-D99758B5FFA3"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D1E8CFC5-51FE-4D75-845F-D70C30AF11B0"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBFBA966-E052-4350-9544-3B5D484DBB6B"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF1E586D-0E88-447A-95E8-5203EF869ADB"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BC087C4-CB10-46D4-A746-0C462354410C"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59389EA2-3067-4AF8-AEC5-FE79E269C170"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "445FA7CD-D0AE-4176-9AE5-293B918DE654"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1B4A7366-0304-431E-B3E4-719BA575CEAC"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8512B4A-5269-4067-B9C6-475A4E8AD313"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "179C6166-87E1-44F8-B727-CDDE40C673D9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*",
"matchCriteriaId": "584107CC-6136-4AA1-AE68-73B93BDDB5B6"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9295217E-C1A0-4A69-A0F0-C44814BB376C"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC49246-2166-4681-8D67-4C0940884872"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CC853916-8BDC-4F7C-BA53-D6AB490A9444"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DCB1A254-DA3C-4032-B2C6-C9EBCE8EC15E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D3562304-0317-4A3C-B622-D5CE01CC97F9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:*",
"matchCriteriaId": "327BA50A-366A-4367-93B8-328EC0136FA7"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D92ABD52-20F6-4AB1-801F-9E7B7B1B78A1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3552F3BB-8021-4E87-987D-870699A7E619"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4ECAE1D7-9868-4730-B645-44CB1B6FDE96"
}
]
}
]
}
],
"references": [
{
"url": "https://psirt.watchguard.com/CVE-2026-13368",
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"tags": [
"Broken Link"
]
},
{
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023",
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"tags": [
"Vendor Advisory"
]
}
]
}