CVE-2026-13368
critical · 9.2WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.
9.2
CVSS
1.0%
EPSS (exploit prob.)
62nd
EPSS percentile
2026-07-03
Published
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-416
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| watchguard | fireware | >= 2025.1, < 2026.2.1 |
| watchguard | firebox_m295 | all versions |
| watchguard | firebox_m395 | all versions |
| watchguard | firebox_m495 | all versions |
| watchguard | firebox_m595 | all versions |
| watchguard | firebox_m695 | all versions |
| watchguard | firebox_t115-w | all versions |
| watchguard | firebox_t125 | all versions |
| watchguard | firebox_t125-w | all versions |
| watchguard | firebox_t145 | all versions |
| watchguard | firebox_t145-w | all versions |
| watchguard | firebox_t185 | all versions |
| watchguard | fireware | >= 12.5, < 12.5.19 |
| watchguard | firebox_t15 | all versions |
| watchguard | firebox_t35 | all versions |
| watchguard | fireware | >= 11.0.0, < 11.12.4 |
| watchguard | fireware | 11.12.4 |
| watchguard | fireware | 11.12.4 |
| watchguard | fireware | >= 12.0, < 12.12.1 |
| watchguard | firebox_cloud | all versions |
| watchguard | firebox_m270 | all versions |
| watchguard | firebox_m290 | all versions |
| watchguard | firebox_m370 | all versions |
| watchguard | firebox_m390 | all versions |
| watchguard | firebox_m440 | all versions |
| watchguard | firebox_m4600 | all versions |
| watchguard | firebox_m470 | all versions |
| watchguard | firebox_m4800 | all versions |
| watchguard | firebox_m5600 | all versions |
| watchguard | firebox_m570 | all versions |
| watchguard | firebox_m5800 | all versions |
| watchguard | firebox_m590 | all versions |
| watchguard | firebox_m670 | all versions |
| watchguard | firebox_m690 | all versions |
| watchguard | firebox_nv5 | all versions |
| watchguard | firebox_t20 | all versions |
| watchguard | firebox_t25 | all versions |
| watchguard | firebox_t40 | all versions |
| watchguard | firebox_t45 | all versions |
| watchguard | firebox_t55 | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-13368