WatchGuard Fireware OS up to 11.12.4+541730/12.5.17/12.11/2026.2 use after free

Summaryinfo

A vulnerability was found in WatchGuard Fireware OS up to 11.12.4+541730/12.5.17/12.11/2026.2. It has been declared as critical. Impacted is an unknown function. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2026-13368. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in WatchGuard Fireware OS up to 11.12.4+541730/12.5.17/12.11/2026.2. It has been declared as very critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

The weakness was presented by Cody Sixteen as wgsa-2026-00023. The advisory is available at watchguard.com. This vulnerability was named CVE-2026-13368 since 06/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/03/2026).

Upgrading to version 12.5.18 or 12.12 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• WatchGuard

Name

• Fireware OS

Version

• 11.12.4+541730
• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.5.0
• 12.5.1
• 12.5.2
• 12.5.3
• 12.5.4
• 12.5.5
• 12.5.6
• 12.5.7
• 12.5.8
• 12.5.9
• 12.5.10
• 12.5.11
• 12.5.12
• 12.5.13
• 12.5.14
• 12.5.15
• 12.5.16
• 12.5.17
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 2026.0
• 2026.1
• 2026.2

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion