TI-2026-15753 Aliases CVE-2026-19315 GHSA-mv65-j857-xm58

Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

MEDIUM 49CWE-125Published 2026-08-27 · Updated 2026-09-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00701 53rd percentileScored 2026-11-07

Fix Fixed Fireware OS (WatchGuard): 2026.2.2, 12.12.2, 2026.3.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WatchGuard	Fireware OS	2025.0 to before 2026.2.2; 12.0 to before 12.12.2; 2026.3 to before 2026.3.1	2026.2.2, 12.12.2, 2026.3.1	Patch available	CNA
WatchGuard	Fireware OS	12.0 to before 12.5.20	12.5.20	Patch available	CNA

Fireware OS VendorWatchGuard Affected 2025.0 to before 2026.2.2; 12.0 to before 12.12.2; 2026.3 to before 2026.3.1 Fixed in 2026.2.2, 12.12.2, 2026.3.1 Patch available CNA
Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.20 Fixed in 12.5.20 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:watchguard:fireware::::::::	—	—	WatchGuard

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard

Remediation

Fix · CNA Fireware OS (WatchGuard) Fixed in 2026.2.2, 12.12.2, 2026.3.1
Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.20

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-27
WatchGuard Fireware OS 12.12.2, 12.5.20 and 2 more versions
9 records Highest priority Priority MEDIUM 8 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-11133 Fireware OS Stack-Based Buffer Overflow in Mobile Security epm EndpointPriority MEDIUM 49
- TI-2026-54282 Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)Priority MEDIUM 44
- TI-2026-54280 Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)Priority MEDIUM 44
Show all 9 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-19315
2026-10-03 Alias added: GHSA-mv65-j857-xm58
2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://psirt.watchguard.com/CVE-2026-19315

TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5

See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences