CVE-2026-19316

Deferred Deferred - Pending Action

Double-Free DoS in WatchGuard Fireware OS iked Process

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: WatchGuard Technologies, Inc.

Description

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-19316

EUVD

EUVD-2026-67332

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	fireware_os	From 2025.0 (inc) to 2026.2.2 (exc)
watchguard	fireware_os	From 12.0 (inc) to 12.12.2 (exc)
watchguard	fireware_os	to 12.5.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in WatchGuard Fireware OS's iked process. It allows a remote unauthenticated attacker to cause a Denial of Service (DoS) by sending specially crafted network traffic. The vulnerability triggers a double-free or use-after-free condition in the IKEv2 daemon (iked), causing the process to crash and respawn, which disrupts VPN services.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the iked process or VPN service disruptions. WatchGuard Fireware OS logs may show repeated crashes of the iked daemon after receiving UDP traffic. Check system logs for entries related to iked process termination or VPN service failures. No specific commands are provided in the resources, but monitoring tools like syslog or network traffic analyzers could help identify unusual UDP traffic patterns targeting VPN ports.

Impact Analysis

The primary impact is a crash of the iked process, leading to disrupted VPN services. While remote code execution was not confirmed, attacker-controlled payloads could potentially cause heap corruption. The vulnerability is triggered by a single UDP packet, making it easy to exploit remotely.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) in VPN services by crashing the iked process, which could disrupt secure communications. While not directly violating GDPR or HIPAA, such disruptions may impact data availability and integrity requirements under these regulations. Organizations relying on VPNs for secure data transmission could face compliance risks if services are unavailable.

Mitigation Strategies

Immediately update Fireware OS to versions 2026.2.2, 12.12.2, or 12.5.20 or later. If immediate patching is not possible, restrict access to UDP ports used by IKEv2 (typically UDP 500 and 4500) via firewall rules to limit exposure. Monitor VPN service stability and iked process health closely.

Hi! I’m here to help you understand CVE-2026-19316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70