Null Pointer Dereference in WatchGuard Fireware OS iked Process
Priority MEDIUM 45CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 2026.2.1, 12.12.1, 12.11.9 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 2025.1 to before 2026.2.1; 12.0 to before 12.12.1; 11.10.2 and later | 2026.2.1, 12.12.1 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.11.9 | 12.11.9 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.5.19 | 12.5.19 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 2025.1 to before 2026.2.1; 12.0 to before 12.12.1; 11.10.2 and later Fixed in 2026.2.1, 12.12.1 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.11.9 Fixed in 12.11.9 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.19 Fixed in 12.5.19 Patch available CNA
CPE configurations NVD · 44
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.5 to before 12.5.19 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 11.0.0 to before 11.12.4 | Vulnerable | WatchGuard |
| cpe:2.3:o:watchguard:fireware:11.12.4:-:*:*:*:*:*:* | 11.12.4 | Vulnerable | WatchGuard |
| cpe:2.3:o:watchguard:fireware:11.12.4:u1:*:*:*:*:*:* | 11.12.4 u1 | Vulnerable | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.0 to before 12.12.1 | Vulnerable | WatchGuard |
| cpe:2.3:a:watchguard:firebox_cloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.5 to before 12.5.19 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.12.4 Vulnerable ·WatchGuard
- cpe:2.3:o:watchguard:fireware:11.12.4:-:*:*:*:*:*:* Versions 11.12.4 Vulnerable ·WatchGuard
- cpe:2.3:o:watchguard:fireware:11.12.4:u1:*:*:*:*:*:* Versions 11.12.4 u1 Vulnerable ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.0 to before 12.12.1 Vulnerable ·WatchGuard
- cpe:2.3:a:watchguard:firebox_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Show 34 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 2025.1 to before 2026.2.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 2025.1 to before 2026.2.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 2026.2.1, 12.12.1
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.11.9
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WatchGuard Fireware OS 12.11.9, 12.12.1, 2026.2.1
16 records Highest priority Priority MEDIUM 7 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-11326 WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationPriority MEDIUM 43
- TI-2026-11340 WatchGuard Firebox wgagent Out of Bounds Write VulnerabilityPriority MEDIUM 40
- TI-2026-11339 WatchGuard Firebox ikestubd Out of Bounds Write VulnerabilityPriority MEDIUM 40
- Release ·
WatchGuard Fireware OS 12.5.19
14 records Highest priority Priority MEDIUM 7 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-11326 WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP AuthenticationPriority MEDIUM 43
- TI-2026-11340 WatchGuard Firebox wgagent Out of Bounds Write VulnerabilityPriority MEDIUM 40
- TI-2026-11339 WatchGuard Firebox ikestubd Out of Bounds Write VulnerabilityPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13084
- 2026-10-03 Alias added: GHSA-w44g-4gmf-m2ww
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2026-13084 · CVE Program
- CVE-2026-13084 · NVD
- FIRST EPSS
- GHSA-w44g-4gmf-m2ww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences