Cloud Security

WatchGuard’s Third iked RCE: CVE-2026-13368 Strands T15/T35

July 7, 2026 · 9 min read · By CloudAI Security

WatchGuard patched CVE-2026-13368 on July 2, 2026, a critical CVSS 9.2 pre-authentication remote code execution flaw in the IKEv2 VPN daemon of every supported Firebox model. It is the third critical RCE discovered in the same iked code path in ten months, both predecessors were weaponized within weeks of disclosure, and T15/T35 appliances on Fireware 12.5.x currently have no available patch.

Key Points

CVE: CVE-2026-13368, CVSS 4.0 score 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H), pre-authentication, network-reachable.
Root cause: race condition producing a use-after-free in the LDAP authentication path of Mobile User VPN with IKEv2.
Attack surface: only Fireboxes configured with Mobile VPN IKEv2 against an external LDAP server; local-auth or alternate VPN methods are not exposed.
Patches: Fireware OS 2026.2.1 and 12.12.1, released July 2, 2026.
Unpatched gaps: T15 and T35 on the 12.5.x branch remain unresolved; Fireware 11.x is end-of-life with no fix planned.
Pattern: third critical pre-auth iked RCE since September 2025, after CVE-2025-9242 and CVE-2025-14733 — both actively exploited.

What CVE-2026-13368 Actually Does

The flaw lives at the intersection of two of the hardest bug classes to reason about: a race condition and a use-after-free. IKEv2 — the Internet Key Exchange version 2 protocol defined in RFC 7296 — runs authentication negotiation for every VPN tunnel the Firebox terminates. When a Firebox is configured to authenticate Mobile User VPN clients against an external LDAP directory, the iked process must reach out to that LDAP server during the IKE_AUTH phase before the session completes.

CVE-2026-13368 exploits the timing window inside that handshake. By sending a crafted request that races with the LDAP lookup, an attacker forces iked to access memory that has already been freed. When the attacker controls the data placed in that freed region — the defining characteristic of a use-after-free exploit — the result is arbitrary code execution in the context of the iked process, which runs with elevated privileges and holds locally stored secrets including VPN keys. The official WatchGuard PSIRT advisory, WGSA-2026-00023, classifies the impact as high across confidentiality, integrity, and availability. The vulnerability was credited to independent researcher Cody Sixteen.

Because the IKEv2 negotiation phase is, by protocol design, reachable by unauthenticated network traffic — it establishes trust before identity is verified — there is no authentication barrier between an attacker on the internet and the vulnerable code path. The CVSS 4.0 vector encodes this directly: AV:N (network-accessible), PR:N (no privileges required), UI:N (no user interaction). The two constraining metrics are AC:H (attack complexity high, reflecting the precise timing a race condition demands) and AT:P (attack requirements present — the device must be configured for external LDAP auth on Mobile VPN IKEv2). Organizations on local authentication or a different VPN method are not in scope, per the NVD record.

The iked Pattern: Three Flaws

CVE-2026-13368 is not an isolated defect. It is the third critical pre-authentication RCE discovered in the Firebox IKEv2 VPN stack since September 2025, and that pattern should reshape how defenders read this disclosure. Each flaw is technically distinct, but all three live in the same iked daemon that manages every VPN tunnel negotiation on the appliance.

CVE	Disclosed	CVSS	Class	Affected configs	Exploited	CISA KEV
CVE-2025-9242	Sep 2025	9.3	Out-of-bounds write (iked)	Mobile VPN IKEv2	Yes (within ~1 month)	Yes
CVE-2025-14733	Dec 2025	9.3	Out-of-bounds write (iked)	Mobile VPN IKEv2 + BOVPN dynamic peer	Yes (zero-day at disclosure)	Yes (next day)
CVE-2026-13368	Jul 2026	9.2	Race condition / use-after-free (LDAP auth)	Mobile VPN IKEv2 + external LDAP	Not yet confirmed	Pending

The technical divergence matters: an organization exempt from one flaw may be squarely exposed by another. CVE-2025-14733 required a Branch Office VPN dynamic gateway peer; CVE-2026-13368 requires external LDAP on Mobile VPN IKEv2. Treating “we weren’t vulnerable last time” as evidence of safety this time is a category error — the same false comfort that catches defenders when a single vendor ships its eighth SD-WAN zero-day in a year.

Why Both Prior Bugs Exploited

The history of the two predecessors is the only honest basis for forecasting CVE-2026-13368’s trajectory, and that history is ugly. In September 2025, WatchGuard released CVE-2025-9242 without exploitation evidence. Within a month, the company updated the advisory to confirm active exploitation, and the Shadowserver Foundation’s internet-wide scans found more than 75,000 Firebox devices still unpatched — most concentrated in North America and Europe, according to BleepingComputer’s coverage. CISA subsequently added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate.

December’s CVE-2025-14733 was worse. WatchGuard confirmed active exploitation on the day of disclosure — a weaponized zero-day, not a theoretical risk. Shadowserver counted approximately 124,658 exposed Firebox devices the weekend after the advisory, with more than 35,000 in the United States alone. CISA added it to the KEV catalog within 24 hours and gave federal agencies one week, until December 26, to patch under Binding Operational Directive 22-01. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA warned at the time.

The lesson is structural, not anecdotal. As Caitlin Condon, then vice president of security research at VulnCheck, observed after CVE-2025-14733’s disclosure: memory-corruption flaws of this class are valuable to adversaries because successful exploitation typically grants high-privileged RCE, even though they can be tricky to weaponize and sometimes demand per-target knowledge such as hard-coded memory addresses. Two out of two predecessors crossed from disclosure to in-the-wild exploitation inside weeks. There is no responsible basis to assume the third will behave differently.

T15 and T35 Have No Patch

The most operationally urgent detail in the July 2 advisory is the explicit unresolved status for two hardware tiers. WatchGuard’s resolution table shows Fireware OS 2025.1.x fixed in 2026.2.1, the 12.x branch fixed in 12.12.1, the 12.5.x branch for T15 and T35 models marked Unresolved, and Fireware OS 11.x listed as end-of-life with no patch forthcoming. The advisory’s “Workaround Available” field is set to False.

That leaves T15 and T35 customers on the 12.5.x branch in an indefinite window of exposure with no vendor fix and no officially sanctioned workaround. These are entry-level desktop appliances heavily deployed in small branch offices and MSP-managed SMB estates — exactly the environments where patch hygiene is weakest and where a single compromised edge device becomes a foothold into a larger network. The WGSA-2026-00023 advisory page is the authoritative source to monitor for a 12.5.x resolution; until it ships, defenders on those models cannot rely on the vendor.

Detection: iked Crashes and Hangs

WatchGuard’s prior advisories documented attacker behavior that doubles as a detection baseline for the new flaw. During a successful CVE-2025-14733 exploit, the iked process hangs — interrupting VPN tunnel negotiations and rekeying — and after a failed or successful attempt, iked crashes and generates a fault report. A specific log pattern served as a strong indicator: an IKE_AUTH request carrying a CERT payload larger than 2,000 bytes. Four attacker-controlled IP addresses were published as indicators of compromise in advisory WGSA-2025-00027.

For CVE-2026-13368, defenders should baseline the same signals — unexplained iked restarts, spiking IKEv2 negotiation failures, fault reports on appliances configured for external LDAP auth — and treat any anomaly on an unpatched device as presumptively malicious. Because the new flaw is a race condition rather than an out-of-bounds write, the crash signature may differ; the absence of the old IoCs does not equal the absence of attack. Correlate WatchGuard fault reports with anomalous LDAP-side traffic and unexpected outbound connections from the appliance itself.

Mitigation Before You Can Patch

For appliances with an available patch, the path is direct: upgrade to Fireware 2026.2.1 or 12.12.1 and rotate all locally stored secrets on any device that was exposed. For T15/T35 on 12.5.x, where no fix exists and no workaround is officially offered, defenders must engineer their own controls:

Eliminate the precondition. If Mobile VPN IKEv2 does not require external LDAP, migrate authentication to a local database or a different VPN method. Removing the LDAP binding removes the vulnerable code path entirely — this is the single most reliable compensating control.
Restrict IKEv2 exposure. Limit UDP 500 and UDP 4500, the IKEv2 listening ports, to known corporate egress ranges only. The attack requires network reachability; an appliance that only accepts IKEv2 from trusted CIDRs is substantially harder to hit.
Accelerate hardware lifecycle. T15 and T35 on the 12.5.x branch now sit on an unpatchable critical path. Treat the absence of a fix as a procurement trigger, not a waiting problem — replace or relocate these appliances off internet-facing VPN duty.
Rotate secrets post-exposure. On any device that shows iked crash or hang anomalies, rotate VPN preshared keys, certificates, and any LDAP bind credentials the appliance holds. A compromised iked process is equivalent to administrative control of the perimeter.
Watch the KEV list. If CISA adds CVE-2026-13368 to the catalog — which the prior two precedent strongly suggest — federal scope and downstream insurer and regulator expectations will follow within days.

What This Means for Defenders

Three critical pre-auth RCEs in one daemon inside ten months is not bad luck; it is a signal about the codebase. The iked implementation that handles IKEv2 on Fireware OS has now produced exploitable memory-corruption flaws on a near-quarterly cadence, each discovered by external research rather than internal fuzzing, and each targeting a code path that is internet-reachable and privilege-rich. Defenders should assume a fourth will follow.

The practical consequence is that perimeter appliances running Fireware must be reclassified as high-risk, rapidly-patchable infrastructure, not set-and-forget edge gear. That means inventory accuracy (which model, which Fireware branch, which VPN and auth configuration), a pre-staged patch runbook with a sub-72-hour SLA, and a hardware-refresh plan that retires any branch — 12.5.x today, 11.x always — the moment it falls out of vendor support. WatchGuard’s advisory and the NVD entry are the canonical references; the CISA KEV catalog is where to watch for the federal remediation deadline that prior precedent says is coming.

CitrixBleed CVE-2026-8451: NetScaler popped in 24 hours — another edge VPN appliance where attackers moved faster than patch cycles.
FortiSandbox exploited, FortiBleed hits 86K firewalls — a parallel case of memory-corruption flaws cascading across a firewall vendor’s fleet.