PT-2026-55327 · Watchguard · Fireware Os

Cody Sixteen · Published 2026-07-02 · Updated 2026-07-03 · CVE-2026-13368

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.0 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.12 WatchGuard Fireware OS versions 2025.1 through 2026.2

Description A race condition leads to a use-after-free issue during LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker can exploit this to execute arbitrary code within the context of the iked process on devices configured to use an external LDAP authentication server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-13368

Affected Products

Fireware Os

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-13368 · Security Note
• https://watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023 · Vendor Advisory
• https://twitter.com/vuldb/status/2072906001028915418 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2072864615701127604 · Twitter Post
• https://twitter.com/CVEnew/status/2072867223119536537 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072868258345095534 · Twitter Post