CVE-2026-13084: Null Pointer Dereference in WatchGuard Fireware OS iked Process
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.
This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13084?
CVE-2026-13084 has a severity rating of high with a CVSS score of 8.7.
How do I fix CVE-2026-13084?
To mitigate CVE-2026-13084, ensure that you update your WatchGuard Fireware OS to the latest patched version.
What type of attack can be performed using CVE-2026-13084?
CVE-2026-13084 can be exploited by an attacker to create a denial-of-service (DoS) condition.
Which services are affected by CVE-2026-13084?
CVE-2026-13084 affects the Mobile User VPN and the Branch Office VPN that utilize IKEv2.
Is authentication required to exploit CVE-2026-13084?
No, CVE-2026-13084 can be exploited by a remote unauthenticated attacker.