CVE-2026-13368

EPSS 1.01%
Veröffentlicht 02.07.2026 23:06:32
Zuletzt bearbeitet 14.08.2026 13:04:59
CVE-Watchlists
Login
Unerledigt
Login

WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 6 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Watchguard ≫ Fireware Version >= 2025.1 < 2026.2.1

   Watchguard ≫ Firebox M295 Version-
   Watchguard ≫ Firebox M395 Version-
   Watchguard ≫ Firebox M495 Version-
   Watchguard ≫ Firebox M595 Version-
   Watchguard ≫ Firebox M695 Version-
   Watchguard ≫ Firebox T115-w Version-
   Watchguard ≫ Firebox T125 Version-
   Watchguard ≫ Firebox T125-w Version-
   Watchguard ≫ Firebox T145 Version-
   Watchguard ≫ Firebox T145-w Version-
   Watchguard ≫ Firebox T185 Version-

Watchguard ≫ Fireware Version >= 12.5 < 12.5.19

Watchguard ≫ Firebox T15 Version-
Watchguard ≫ Firebox T35 Version-

Watchguard ≫ Fireware Version >= 11.0.0 < 11.12.4

Watchguard ≫ Fireware Version11.12.4 Update-

Watchguard ≫ Fireware Version11.12.4 Updateu1

Watchguard ≫ Fireware Version >= 12.0 < 12.12.1

   Watchguard ≫ Firebox Cloud Version-
   Watchguard ≫ Firebox M270 Version-
   Watchguard ≫ Firebox M290 Version-
   Watchguard ≫ Firebox M370 Version-
   Watchguard ≫ Firebox M390 Version-
   Watchguard ≫ Firebox M440 Version-
   Watchguard ≫ Firebox M4600 Version-
   Watchguard ≫ Firebox M470 Version-
   Watchguard ≫ Firebox M4800 Version-
   Watchguard ≫ Firebox M5600 Version-
   Watchguard ≫ Firebox M570 Version-
   Watchguard ≫ Firebox M5800 Version-
   Watchguard ≫ Firebox M590 Version-
   Watchguard ≫ Firebox M670 Version-
   Watchguard ≫ Firebox M690 Version-
   Watchguard ≫ Firebox Nv5 Version-
   Watchguard ≫ Firebox T20 Version-
   Watchguard ≫ Firebox T25 Version-
   Watchguard ≫ Firebox T40 Version-
   Watchguard ≫ Firebox T45 Version-
   Watchguard ≫ Firebox T55 Version-
   Watchguard ≫ Firebox T70 Version-
   Watchguard ≫ Firebox T80 Version-
   Watchguard ≫ Firebox T85 Version-
   Watchguard ≫ Fireboxv Version-

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.01%	0.602

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5d1c2695-1a31-4499-88ae-e847036fd7e3	9.2	0	0	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023

Vendor Advisory

https://psirt.watchguard.com/CVE-2026-13368

Broken Link

https://nvd.nist.gov/vuln/detail/CVE-2026-13368

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-13368

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-13368

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-13368