CVE-2026-19315

Deferred Deferred - Pending Action

Type Confusion in WatchGuard Fireware OS iked Process

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: WatchGuard Technologies, Inc.

Description

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-19315

EUVD

EUVD-2026-67339

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	fireware_os	From 2025.0 (inc) to 2026.2.2 (exc)
watchguard	fireware_os	to 12.12.2 (exc)
watchguard	fireware_os	to 12.5.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-763	The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a type confusion vulnerability in the iked process of WatchGuard Fireware OS. It allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic. The flaw involves sending a maliciously crafted IKE_AUTH message with two EAP payloads, causing the IKE daemon to crash and potentially leading to memory corruption and remote code execution.

Detection Guidance

Detecting this vulnerability requires monitoring the iked process on WatchGuard Fireware OS for crashes or unusual behavior. Check logs for IKE_AUTH message processing errors or process termination events. WatchGuard Fireware OS logs can be reviewed via the web interface or CLI using commands like 'show log iked' or 'show log system'. Network traffic inspection for malformed IKE_AUTH messages with two EAP payloads may also indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to crash the iked process, causing a denial-of-service condition. In some cases, it may allow further memory corruption and potential remote code execution, compromising the affected system. This could disrupt network services relying on the IKE daemon.

Compliance Impact

This vulnerability allows remote unauthenticated attackers to execute arbitrary code, which could lead to unauthorized access to sensitive data. Such breaches may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in non-compliance and legal penalties.

Mitigation Strategies

Immediately update affected WatchGuard Fireware OS versions to the latest patched releases: Fireware OS 2026.2.2, Fireware OS 12.12.2, or Fireware OS 12.5.20. If immediate patching is not possible, restrict network access to the IKE daemon (iked) via firewall rules to limit exposure to crafted IKE_AUTH messages.

Hi! I’m here to help you understand CVE-2026-19315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70