CVE-2026-13368: WatchGuard Fireware Use-After-Free RCE

CVE-2026-13368 Overview

CVE-2026-13368 is a race condition leading to a use-after-free vulnerability [CWE-416] in the Lightweight Directory Access Protocol (LDAP) authentication path of WatchGuard Fireware OS. The flaw resides in the Mobile User VPN with Internet Key Exchange version 2 (IKEv2) component. A remote unauthenticated attacker can exploit the flaw to execute arbitrary code within the context of the iked process on Fireboxes configured with an external LDAP authentication server for Mobile VPN with IKEv2.

Critical Impact
Remote unauthenticated attackers can achieve arbitrary code execution on the Firebox iked process, compromising perimeter VPN gateways.

Affected Products

WatchGuard Fireware OS 11.0 up to and including 11.12.4_Update1
WatchGuard Fireware OS 12.0 up to and including 12.12
WatchGuard Fireware OS 2025.1 up to and including 2026.2

Discovery Timeline

2026-07-03 - CVE-2026-13368 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-13368

Vulnerability Analysis

CVE-2026-13368 combines two weakness classes: a race condition and a use-after-free [CWE-416]. Concurrent execution paths inside the iked process handle LDAP authentication for IKEv2 Mobile VPN sessions. Under specific timing conditions, one thread frees a memory object while another thread continues to reference it. The dangling pointer is then dereferenced, allowing an attacker who controls the timing and content of authentication traffic to corrupt memory in iked.

Successful exploitation results in arbitrary code execution in the context of the iked daemon. The iked process handles IKE negotiation at the network edge, so compromise grants attackers a foothold on the firewall itself. Attack complexity is elevated because the attacker must win the race window and the target Firebox must be configured for external LDAP authentication.

Root Cause

The root cause is improper synchronization between threads or asynchronous callbacks that manage LDAP session state during IKEv2 authentication. One code path releases a heap object representing authentication or session context. A parallel path retains a stale reference and later reads or writes the freed region. This use-after-free enables controlled memory reuse and, ultimately, hijacking of execution flow within iked.

Attack Vector

The vulnerability is exploitable over the network without prior authentication. The attacker targets the IKEv2 service exposed by Mobile VPN on the Firebox and triggers LDAP authentication attempts to reach the vulnerable code path. By issuing concurrent or carefully timed IKEv2 authentication requests, the attacker forces the race condition and dereferences the freed object. Only Fireboxes with Mobile VPN with IKEv2 configured to use an external LDAP authentication server are exploitable. No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the WatchGuard Security Advisory for vendor technical details.

Detection Methods for CVE-2026-13368

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the iked process on affected Fireboxes.
Anomalous IKEv2 authentication traffic patterns, especially rapid concurrent authentication attempts from a single or small set of source addresses.
Outbound connections from the Firebox management plane to untrusted destinations following IKEv2 activity.
LDAP authentication server logs showing rapid, malformed, or aborted bind attempts correlated with Mobile VPN sessions.

Detection Strategies

Monitor Firebox system logs for iked service faults, segmentation faults, or unexpected daemon restarts.
Baseline normal IKEv2 authentication volume per source and alert on statistically anomalous bursts.
Correlate Firebox VPN logs with LDAP server logs to detect authentication timing anomalies indicative of race exploitation.

Monitoring Recommendations

Forward Firebox logs and LDAP authentication server logs to a centralized SIEM for correlation and long-term retention.
Enable alerting on repeated iked restarts within short intervals, which may indicate exploit attempts.
Continuously review IKEv2 endpoint exposure and restrict source ranges where operationally feasible.

How to Mitigate CVE-2026-13368

Immediate Actions Required

Apply the WatchGuard-supplied Fireware OS updates referenced in the WatchGuard Security Advisory WGSA-2026-00023.
Inventory all Fireboxes to identify devices running Fireware OS 11.0–11.12.4_Update1, 12.0–12.12, or 2025.1–2026.2 with Mobile VPN with IKEv2 configured for external LDAP authentication.
Restrict IKEv2 exposure to known client IP ranges using geolocation or ACL policies where practical.
Increase monitoring of iked process health and IKEv2 authentication activity until patches are deployed.

Patch Information

WatchGuard has published a security advisory detailing fixed Fireware OS versions. Administrators should upgrade to the vendor-recommended fixed release for each affected branch. Refer to the WatchGuard Security Advisory for exact fixed version numbers and upgrade guidance.

Workarounds

Where patching is not immediately possible, switch Mobile VPN with IKEv2 authentication from external LDAP to a non-affected authentication method such as Firebox-DB or RADIUS.
Disable Mobile VPN with IKEv2 on affected Fireboxes if the service is not required for business operations.
Restrict IKEv2 inbound traffic to trusted source networks using firewall policies to reduce the attack surface until updates are applied.

bash

# Configuration example
# Refer to the WatchGuard advisory for authoritative remediation steps.
# https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023