← News
/DISPATCH · 2026-09-02

WatchGuard Patches 26 Vulnerabilities: Three Unauthenticated CVSS 9.3 RCEs in Fireware OS iked

WatchGuard issued advisories patching 26 vulnerabilities in Fireware OS and Dimension. Five are critical. Three unauthenticated RCEs sit in the firewall's VPN key-exchange process and punch through the perimeter.

WatchGuard's patch drop is unusually large. The firewall vendor issued multiple security advisories fixing 26 vulnerabilities across Fireware OS and the Dimension management platform. Five are critical. Three unauthenticated remote code execution bugs sit in the firewall's own VPN key-exchange process.

Incident Overview

The three most severe bugs cluster in Fireware OS's iked daemon—the component that handles IPsec VPN negotiation and key establishment (IKEv1/IKEv2):

All three can be triggered by crafted network traffic with no authentication, executing code on the device. CVSS 9.3 each. A fourth critical, CVE-2026-13086, is in the epm service used by the deprecated Mobile Security feature—also unauthenticated RCE. Fifth, CVE-2026-78174 on Dimension: a low-privilege admin can extract a super-admin session ID and CSRF token and take over the account.

Technical Details

Firewall bugs invert the role. These devices are the perimeter. Compromise iked and the attacker has a foothold inside the defensive stack—sniff VPN traffic, rewrite policy, or move laterally. Memory-corruption bugs (overflows, type confusion) in IKE parsing are unsurprising. IKE message parsing is complex, the state machine is large, and it has been a recurring high-risk area on network gear.

The same update includes 7 high-severity issues (6 can DoS iked) and 11 medium. WatchGuard says it has not observed in-the-wild exploitation.

Impact Assessment

WatchGuard Firebox is widely deployed in SMB. VPN services must be internet-facing, so the attack surface is open by design. No in-the-wild reports yet, but Fortinet and Ivanti history says the window from disclosure to weaponization is short.

Remediation

Sources