CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

WatchGuard Fireware OS iked - pre-auth type confusion via duplicated EAP payload in IKE_AUTH, yielding RCE

cve · CVE-2026-19315 single-source

Coverage
1
first 2026-08-31 → last 2026-09-29
Latest activity
2026-09-29
WatchGuard tells Firebox admins to update now: three unauthenticated code-execution paths sit in the IKE/VPN…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
8
4 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-19315, newest first. Check the date before acting on an older one.

  • Patch every WatchGuard Firebox to Fireware OS >= 2026.2.2 / 12.12.2 / 12.5.20 (T15/T35: >= 12.5.20) now, and separately to >= 2026.3.1 on any appliance already running a 2026.3.x build: WatchGuard places a 2026.3 affected band on each of the four iked and epm flaws (on the Default product row for two of them and the T15/T35 row for the other two), and the 2026.2.2 fix does not cover it. Where immediate patching is not possible, restrict IKE/VPN exposure to trusted interfaces and, as an inference from the service's role rather than a documented WatchGuard mitigation, disable the deprecated Mobile Security feature to take the epm service out of reach.
    2026-08-31CVE-2026-19313 +4
  • Patch every WatchGuard Dimension instance to >= 2.3.1 now, and audit which accounts have exported or viewed the web UI diagnostic log; a low-privileged Dimension Administrator account that has done so should be treated as a possible path to Super Administrator compromise.
    2026-08-31CVE-2026-19313 +4

Defender insights

What each entry about CVE-2026-19315 tells a defender to do, newest first.

2026-08-31HIGHWatchGuard tells Firebox admins to update now: three unauthenticated code-execution paths sit in the IKE/VPN daemon itself

Latest update

Story timeline

  1. 2026-08-31WatchGuard Fireware OS: three pre-auth RCEs in the iked IKE/VPN daemon plus a pre-auth stack overflow in the deprecated Mobile Security epm service
    trending-vulnerabilitiesWatchGuard tells Firebox admins to update now: three unauthenticated code-execution paths sit in the IKE/VPN daemon itself

Hunting pivots

Affected products
WatchGuard DimensionWatchGuard FireboxWatchGuard Fireware OS
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Lateral MovementUse Alternate Authentication Material: Web Session Cookie

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-31/watchguard-fireware-ike-vpn-preauth-rce-epm-overflow · ATT&CK page ↗

Lateral Movement TA0008

T1550.004Use Alternate Authentication Material: Web Session Cookie×1

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Evidence: 2026-08-31/watchguard-fireware-ike-vpn-preauth-rce-epm-overflow · ATT&CK page ↗

Entries about WatchGuard Fireware OS iked - pre-auth type confusion via duplicated EAP payload in IKE_AUTH, yielding RCE (1)

2026-08-31 · view entry permalink →

HIGHCVE-2026-19313 +4updatedNATOA2

WatchGuard Fireware OS: three pre-auth RCEs in the iked IKE/VPN daemon plus a pre-auth stack overflow in the deprecated Mobile Security epm service

WatchGuard's 27 August 2026 "Immediate Action Required" advisory ships fixes for eleven CVEs in Fireware OS, reserved under coordinated disclosure and detailed on WatchGuard's PSIRT pages. Two are pre-authentication remote code execution in the iked process, the daemon that handles IKE/IPsec VPN negotiation, each rated CVSS 4.0 9.3 Critical by WatchGuard: CVE-2026-19313 is a heap buffer overflow triggered by specially crafted network traffic reaching iked (WatchGuard PSIRT, 2026-08-27), and CVE-2026-19315 is a type confusion, with an out-of-bounds read and the release of an invalid pointer among its listed weaknesses, that lets a remote unauthenticated attacker execute arbitrary code with crafted network traffic (WatchGuard PSIRT, 2026-08-27). Both flaws need no authentication and no configuration beyond a running iked process, which handles VPN and Mobile IKEv2 negotiation and is commonly reachable from the internet on a Firebox configured as a VPN gateway.

The third flaw, CVE-2026-13086 (also CVSS 4.0 9.3 Critical), is a stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by Fireware's deprecated Mobile Security feature that lets an unauthenticated remote attacker execute arbitrary code, and WatchGuard's weakness list for it also includes the use of hard-coded credentials (WatchGuard PSIRT, 2026-08-27). WatchGuard rates it network-reachable with no privileges, user interaction or attack requirements (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), the same rating as the iked flaws (WatchGuard PSIRT, 2026-08-27), so an appliance with Mobile Security still enabled is exposed on those terms.

All three, along with the remaining eight CVEs WatchGuard's own bulletin lists, are fixed in Fireware OS 2026.3.1, 2026.2.2, 12.12.2 and 12.5.20 (WatchGuard PSIRT, 2026-08-27). The 2026.3 branch is a separate affected band from the 2025.0-2026.2.2 one and takes its own fix: on CVE-2026-19315 (WatchGuard PSIRT, 2026-08-27) and CVE-2026-13086 (WatchGuard PSIRT, 2026-08-27) the band >= 2026.3, < 2026.3.1 sits on the Default product row, and on CVE-2026-19313 (WatchGuard PSIRT, 2026-08-27) and CVE-2026-19318 (WatchGuard PSIRT, 2026-08-27) it sits on the T15/T35 row. WatchGuard states it has not seen any indication that these vulnerabilities have been exploited (WatchGuard, 2026-08-27). Germany's BSI CERT-Bund relayed the same advisory as WID-SEC-2026-3068 the same day, listing a twelfth CVE for the same iked heap-overflow class not present in WatchGuard's own blog roundup, CVE-2026-81851, "Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service" (BSI CERT-Bund, 2026-08-27).

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

WatchGuard PSIRT (CVE-2026-19315)

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

WatchGuard PSIRT (CVE-2026-13086)

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

WatchGuard PSIRT (CVE-2026-19318)

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.

WatchGuard PSIRT (CVE-2026-78174)
Updaterun 2026-09-02T0411Z-intelcvesaffected_productstechniquesactionssummarysourcesevidencesourcing_note

NCSC Switzerland's advisory on the same 27 August bulletin, created 2026-09-01, adds two CVEs this entry had not covered. CVE-2026-19318 (CVSS 9.3) is a third pre-authentication stack buffer overflow in iked that lets a remote unauthenticated attacker execute arbitrary code with crafted network traffic (WatchGuard PSIRT, 2026-08-27).

CVE-2026-78174 (CVSS 9.3) is a different bug class on a different product: WatchGuard Dimension, the centralized reporting and management platform. Dimension's web UI diagnostic log records session identifiers for logged-in users unredacted; a low-privileged Dimension Administrator who retrieves that log can extract a Super Administrator's session token while the Super Administrator is logged in, then impersonate them fully, reaching Access Management, creating, deleting or altering any user or group, changing system-wide configuration, locking out legitimate administrators, and holding persistent full administrative control (WatchGuard PSIRT, 2026-08-27). Both flaws share the same fix cadence as the original three: Fireware OS 2026.3.1 / 2026.2.2 / 12.12.2 / 12.5.20 for CVE-2026-19318, Dimension 2.3.1 for CVE-2026-78174. WatchGuard reports no observed exploitation for either.

Defender takeaway (updated): CVE-2026-19318 applies to every affected appliance running iked, on the same terms as the other two iked flaws. For Dimension, treat diagnostic-log export or viewing as a privileged, logged action and audit which accounts have exercised it; patch to 2.3.1 regardless, since a compromised low-privileged Dimension Administrator account is now a path to full Super Administrator control.

Correctionrun 2026-09-06T1308Z-auditcvessummaryactionsbody

The version ranges recorded for four of the five CVEs were incomplete. WatchGuard's PSIRT page for each lists a second affected band alongside the 2025.0-2026.2.2 and 12.0-12.12.2 ones, >= 2026.3, < 2026.3.1, and names Fireware OS 2026.3.1 in its Solution section alongside 2026.2.2, 12.12.2 and 12.5.20. The band's placement differs by CVE: on CVE-2026-19315 (WatchGuard PSIRT, 2026-08-27) and CVE-2026-13086 (WatchGuard PSIRT, 2026-08-27) it sits on the Default product row, and on CVE-2026-19313 (WatchGuard PSIRT, 2026-08-27) and CVE-2026-19318 (WatchGuard PSIRT, 2026-08-27) on the T15/T35 row.

What this changes for a defender: an appliance running any 2026.3.0 build is in scope for all four flaws, including the two unauthenticated iked code-execution paths, and upgrading it to 2026.2.2 does not remediate them; 2026.3.1 is its fix. CVE-2026-78174 on Dimension is unaffected by this correction, its >= 2.0, < 2.3.1 range matching WatchGuard's page exactly.

Updaterun 2026-09-29T2134Z-auditsummaryevidenceactionstitleheadlinebody

WatchGuard has revised its per-CVE advisories. The current pages rate both flaws exploitable by a remote unauthenticated attacker with no privileges, user interaction or attack requirements, CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N for CVE-2026-19318 (WatchGuard PSIRT, 2026-08-27) and for CVE-2026-13086 (WatchGuard PSIRT, 2026-08-27). They no longer state the preconditions their earlier text carried: IKE payload diagnostic logging for CVE-2026-19318 (WatchGuard PSIRT, 2026-08-27), and network adjacency to a trusted interface for CVE-2026-13086 (WatchGuard PSIRT, 2026-08-27). Disabling IKE payload diagnostic logging is therefore not a documented mitigation for CVE-2026-19318, and an appliance with the deprecated Mobile Security feature enabled is exposed through epm on the same terms as the iked flaws. The fixed releases (Fireware OS 2026.3.1, 2026.2.2, 12.12.2, 12.5.20) are unchanged, and both advisories still state that WatchGuard is not aware of any exploitation in the wild (WatchGuard PSIRT, 2026-08-27) (WatchGuard PSIRT, 2026-08-27).

The pages for CVE-2026-19315 and CVE-2026-19318 also no longer carry the trigger detail their earlier text gave, an IKE_AUTH message with two EAP payloads for CVE-2026-19315 and an EAP-MSCHAPv2 payload with an undersized length field for CVE-2026-19318, or the crash-and-respawn outcome. Both now state remote code execution directly (WatchGuard PSIRT, 2026-08-27) (WatchGuard PSIRT, 2026-08-27). The analysis above no longer offers those details as hunting cues, and it gives iked crashes and respawns only as an inference from the bug class. With CVE-2026-19318 unconditional, three of the iked flaws are unauthenticated code-execution paths.

vulnerability31 Aug 04:40Zsingle-sourceOpen finding →
Sources: WatchGuard Technologies · WatchGuard PSIRT · BSI CERT-Bund · NCSC Switzerland (GovCERT.ch) Cyber Security Hub

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • psirt.watchguard.com5 (62%)
  • security-hub.ncsc.admin.ch1 (12%)
  • watchguard.com1 (12%)
  • wid.cert-bund.de1 (12%)

External references

NVD · cve.org · CISA KEV

All cited sources (8)