CVE-2026-13084: WatchGuard Fireware OS DoS Vulnerability

CVE-2026-13084 Overview

CVE-2026-13084 is a null pointer dereference vulnerability [CWE-476] in WatchGuard Fireware OS. A remote unauthenticated attacker can trigger a denial-of-service (DoS) condition by sending specially crafted Internet Key Exchange version 2 (IKEv2) messages to the affected device. The flaw impacts both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. Successful exploitation crashes the VPN service, disrupting remote access and site-to-site connectivity for downstream users.

Critical Impact
Unauthenticated network attackers can remotely crash IKEv2 VPN services on WatchGuard firewalls, cutting off VPN connectivity for mobile users and branch offices.

Affected Products

WatchGuard Fireware OS 11.10.2 through 11.12.4_Update1
WatchGuard Fireware OS 12.0 through 12.12
WatchGuard Fireware OS 2025.1 through 2026.2

Discovery Timeline

2026-07-03 - CVE-2026-13084 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in the NVD database

Technical Details for CVE-2026-13084

Vulnerability Analysis

The vulnerability resides in the IKEv2 processing logic within WatchGuard Fireware OS. The IKEv2 protocol negotiates security associations for IPsec VPN tunnels and is exposed on UDP ports 500 and 4500. When the daemon parses a malformed IKEv2 message, execution reaches a code path where a pointer is dereferenced without validation, producing a null pointer dereference and terminating the process.

Because IKEv2 negotiation occurs prior to authentication, an attacker does not need valid credentials. Any network-reachable attacker who can send UDP packets to the firewall's IKEv2 listener can trigger the condition. The impact is limited to availability: the VPN service becomes unavailable, but confidentiality and integrity of data are not directly affected.

Root Cause

The root cause is missing input validation in the IKEv2 message handler. The affected code path dereferences a pointer whose value can be null when specific fields in the crafted IKEv2 packet fail to populate an expected structure. The condition is classified under [CWE-476] Null Pointer Dereference. Both Mobile User VPN and Branch Office VPN configurations that rely on IKEv2 with a dynamic gateway peer share the vulnerable code path.

Attack Vector

Exploitation requires only network access to the firewall's IKEv2 endpoints. The attacker sends specially crafted IKEv2 packets to the external interface of a Firebox appliance configured for IKEv2 VPN. No authentication, user interaction, or prior foothold is required. The result is a denial-of-service condition affecting the VPN service. Refer to the WatchGuard Security Advisory WGSA-2026-00024 for vendor-provided technical detail.

Detection Methods for CVE-2026-13084

Indicators of Compromise

Unexpected restarts or crashes of the IKEv2 VPN daemon on Firebox appliances.
Repeated IKE_SA_INIT messages from a single external source followed by loss of VPN service.
Sudden disconnection of Mobile User VPN or Branch Office VPN tunnels without a configuration change.
Firewall log entries referencing IKEv2 parsing errors or process termination.

Detection Strategies

Monitor Fireware OS system logs for repeated IKEv2 daemon restarts and abnormal termination events.
Correlate inbound UDP 500 and UDP 4500 traffic spikes with VPN service availability metrics.
Alert on IKEv2 packets containing malformed payloads or unusual header combinations at the perimeter.

Monitoring Recommendations

Forward Firebox logs to a centralized SIEM and create alerts on IKEv2 crash signatures.
Track VPN tunnel uptime and mobile user session counts as availability health indicators.
Enable geo-based and rate-based alerting for IKEv2 negotiation traffic from untrusted sources.

How to Mitigate CVE-2026-13084

Immediate Actions Required

Upgrade WatchGuard Fireware OS to a fixed release as documented in WGSA-2026-00024.
Inventory all Firebox devices to identify appliances running Fireware OS versions in the affected ranges.
Prioritize appliances that terminate Mobile User VPN with IKEv2 or Branch Office VPN with a dynamic gateway peer.
Verify that logging and alerting are enabled for IKEv2 daemon health after upgrade.

Patch Information

WatchGuard published Security Advisory WGSA-2026-00024 with fixed Fireware OS releases. Administrators should consult the advisory for the specific patched build corresponding to their branch (11.x, 12.x, or 2025.1/2026.x) and apply the upgrade through the standard Fireware OS update workflow. See WatchGuard Security Advisory WGSA-2026-00024.

Workarounds

If immediate patching is not feasible, restrict IKEv2 access to known peer IP addresses via firewall policy where the deployment allows static peers.
Disable IKEv2 Mobile User VPN and Branch Office VPN with dynamic gateway peers until the appliance is patched.
Place upstream ACLs or scrubbing controls to drop unsolicited IKEv2 traffic from untrusted networks.

bash

# Configuration example - restrict IKEv2 UDP 500/4500 to known peers
# Applied via WatchGuard policy manager or CLI
policy add name="IKEv2-Restrict" \
  protocol=udp \
  ports=500,4500 \
  from=trusted_peer_group \
  to=firebox_external \
  action=allow
policy add name="IKEv2-Deny-Any" \
  protocol=udp \
  ports=500,4500 \
  from=any-external \
  to=firebox_external \
  action=deny