CVE-2026-78011

Deferred Deferred - Pending Action

Integer Underflow in WatchGuard Fireware OS VPN Processing

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: WatchGuard Technologies, Inc.

Description

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-78011

EUVD

EUVD-2026-67336

Affected Vendors & Products

Vendor	Product	Version / Range
watchguard	fireware_os	From 2025.0 (inc) to 2026.2.2 (exc)
watchguard	fireware_os	From 12.0 (inc) to 12.12.2 (exc)
watchguard	fireware_os	From 12.0 (inc) to 12.5.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an integer underflow vulnerability in WatchGuard Fireware OS's iked process. A remote attacker can send a specially crafted UDP IKEv1 packet to crash the iked process, causing a Denial of Service. In some cases, this may also lead to remote code execution depending on memory layout.

Detection Guidance

Monitor for crashes in the iked process on WatchGuard Fireware OS devices running vulnerable versions. Check for unusual UDP IKEv1 traffic patterns targeting VPN ports. Use network traffic analysis tools like Wireshark to inspect UDP packets for malformed IKEv1 headers or payloads.

Impact Analysis

The vulnerability allows a remote unauthenticated attacker to disrupt VPN services by crashing the iked process, causing network outages or service unavailability. If memory layout permits, it may also enable remote code execution.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by disrupting VPN services, which may lead to unauthorized access or data breaches if exploited. A DoS condition could prevent legitimate users from accessing protected systems, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade Fireware OS to versions 2026.2.2, 12.12.2, or 12.5.20 or later. Block UDP IKEv1 traffic at the network perimeter if not required. Disable unnecessary VPN services until patched. Monitor for iked process crashes or unusual activity.

Hi! I’m here to help you understand CVE-2026-78011. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70