Originally published at HOL

BREAKING: WatchGuard Fireware iked type-confusion on IKE_AUTH

WatchGuard shipped Fireware OS 2026.2.2 and 12.12.2 today (27 August 2026) with a Critical iked cluster. The one to read first is CVE-2026-19315: a remote, unauthenticated IKE_AUTH message that carries two EAP payloads can make iked confuse types, read off the end of a buffer, and free() a pointer the sender influenced. WatchGuard rates that crash as denial of service with potential remote code execution. The same cut also fixes two more pre-auth RCE-class iked bugs (CVE-2026-19313 heap overflow, CVE-2026-19318 stack overflow) plus a row of unauth iked DoS CVEs. This is a new train. It is not the 2 July 2026.2.1 / CVE-2026-13368 LDAP race.

Who is not in scope

Skip the pager if any of these hold. All of these come from the PSIRT tables and the 2026.2.2 / 12.12.2 release notes, not guesses.

• The Firebox already runs Fireware OS 2026.2.2 (build 745723), 12.12.2 (build 745592), or 12.5.20 on T15/T35. Those are the not-affected rows on the CVE-2026-19315 product table.
• iked is not listening. CVE-2026-19315, CVE-2026-19313, and CVE-2026-19318 are reached with IKE_AUTH traffic. A box with no IKEv2 Mobile VPN and no IKEv2 BOVPN is outside that path.
• CVE-2026-19318 only, and IKE payload diagnostic logging is off. WatchGuard says that stack overflow needs that troubleshooting setting enabled. The other iked CVEs do not name that gate.
• CVE-2026-13086 only, and the deprecated Mobile Security epm service is not reachable on a trusted interface. That one is a separate JSON-RPC stack overflow, credited to TrendAI ZDI, not an IKE bug.
• CVE-2026-78008 only. That one is an authenticated administrator hitting the management Web UI / wgagent, not the unauth IKE path.

What this is not

This is not CVE-2026-13368, the 2 July 2026 pre-auth iked use-after-free on Mobile VPN with IKEv2 plus external LDAP, which 2026.2.1 / 12.12.1 already shipped. It is not CVE-2026-81851, the same-day but admin-gated iked config DoS that belongs to the 2026.2.1 train. It is not the WatchGuard Dimension XSS/SQLi/SSRF dump that landed in the same CVE feed. WatchGuard says it is not aware of exploitation of CVE-2026-19315 in the wild. The 19315 write-up is also not a confirmed reliable RCE: the vendor describes a crash plus respawn, then says the attacker-influenced free() may allow further memory corruption.

What broke

iked is the Fireware IKE daemon. For CVE-2026-19315, WatchGuard describes a type confusion (CWE-843) when a remote, unauthenticated peer sends an IKE_AUTH message that contains two EAP payloads. The process then does an out-of-bounds read (CWE-125) and a free() on an attacker-influenced pointer (CWE-763). The observed result is iked dying and being respawned. Because that pointer is attacker-shaped, WatchGuard also marks the CVE Critical (CVSS v4.0 9.3, AV:N/AC:L/AT:N/PR:N/UI:N) for possible code execution. Finder: McCaulay Hudson of watchTowr, the same lab that has been in this iked code before.

CVE-2026-19313 is a separate pre-auth heap overflow in the same daemon (CWE-122 / integer overflow to buffer overflow), same Critical 9.3 vector, same finder, same fixed builds. CVE-2026-19318 is a pre-auth stack overflow after IKE_SA_INIT, via an EAP-MSCHAPv2 payload with an undersized embedded length field, and only if IKE payload diagnostic logging is on.

The 2026.2.2 release notes (27 August 2026) group the unauth set as: CVE-2026-13086, CVE-2026-19313, CVE-2026-19314, CVE-2026-19315, CVE-2026-19316, CVE-2026-19317, CVE-2026-19318, CVE-2026-78009, CVE-2026-78010, CVE-2026-78011. 19314 / 19316 / 19317 / 78009 / 78010 / 78011 are unauth iked DoS (underflow, double-free, OOB read, stack overflow). 13086 is the deprecated Mobile Security epm endpoint on a trusted interface. The notes also list authenticated wgagent memory corruption as CVE-2026-78008, and a kernel local privilege escalation CVE-2026-43284 (Dirty Frag) that is not an IKE bug.

2026.2.2 is the current-hardware train (T115-W, T125, T145, T185, M295, M395, M495, M595, M695). 12.12.2 is the 12.x train (NV5, T20/T25/T40/T45/T80/T85, M270 through M5800, FireboxV, Firebox Cloud). T15/T35 stay on 12.5.x and need 12.5.20 per the PSIRT table.

Operator check

On the Firebox CLI, the documented command is show sysinfo (Fireware CLI Reference, sysinfo: system information). Read the Fireware OS version line. You are still on the old train if you see anything below 2026.2.2 on a 2025/2026 box, below 12.12.2 on a 12.x box, or below 12.5.20 on T15/T35.

show sysinfo

The same version string is on the Fireware Web UI dashboard. Match the model to the train: a T145-W wants 2026.2.2 build 745723, a T80 wants 12.12.2 build 745592, a T15 wants 12.5.20. If you only run SSL VPN or a static-peer BOVPN and iked is not in the process list, the 19315 IKE_AUTH path is not the one that applies; still apply the cut, because 13086 and 78008 ride the same upgrade.

How to fix

Upgrade Fireware OS to one of:

• 2026.2.2 (build 745723, released 27 August 2026) on current T/M 2025-2026 hardware
• 12.12.2 (build 745592, released 27 August 2026) on 12.x Firebox, FireboxV, and Firebox Cloud
• 12.5.20 on T15/T35

Take the image from WatchGuard software downloads for that exact model family. WatchGuard System Manager should be at or above the Fireware version; the 2026.2.2 notes point at WSM v2026.3 build 739088. After the upgrade, run show sysinfo again and confirm IKEv2 tunnels return. Do not stop at 2026.2.1 / 12.12.1. That was the 2 July cut for CVE-2026-13368 and friends, not this train.

References

• HOL Guard evidence pack: CVE-2026-19315
• Vendor: CVE-2026-19315, CVE-2026-19313, CVE-2026-19318
• Release notes: Fireware v2026.2.2 (27 August 2026, build 745723); Fireware v12.12.2 (27 August 2026, build 745592)
• CLI check: show sysinfo in the Fireware Command Line Interface Reference