CVE-2026-13368 | WatchGuard Fireware OS contains a race condition leading to … | CVSS 9.2 CRITICAL

Description

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

Metadata

CVE ID: CVE-2026-13368
State: PUBLISHED
Assigner: WatchGuard
Reserved: 2026-06-25 19:00 UTC
Published: 2026-07-02 23:06 UTC
Last updated: 2026-07-02 23:06 UTC
Primary CWE: CWE-416
CWE-416 Use After Free
Vendor / Product: WatchGuard / Fireware OS
Sources: cve.org · NVD

Severity & Metrics

9.2 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
WatchGuard	Fireware OS	—	11.10.2 ≤ 11.12.4+541730, 12.0 ≤ 12.12, 12.5 ≤ 12.5.18, 2025.1 ≤ 2026.2

Weakness (CWE)

CWE	Source	Description
CWE-416	cna	CWE-416 Use After Free

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.2	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (1)

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023