CVE-2026-13084: Null Pointer Dereference in WatchGuard Fireware OS iked Process
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.
This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 2026.2.1 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.12.1 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.5.19 - Compensating control
As a mitigation for the IKEv2-related DoS issue, avoid using Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 when configured with a dynamic gateway peer until Fireware OS is updated to a fixed release.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13084?
CVE-2026-13084 has a severity rating of high with a CVSS score of 8.7.
How do I fix CVE-2026-13084?
To mitigate CVE-2026-13084, ensure that you update your WatchGuard Fireware OS to the latest patched version.
What type of attack can be performed using CVE-2026-13084?
CVE-2026-13084 can be exploited by an attacker to create a denial-of-service (DoS) condition.
Which services are affected by CVE-2026-13084?
CVE-2026-13084 affects the Mobile User VPN and the Branch Office VPN that utilize IKEv2.
Is authentication required to exploit CVE-2026-13084?
No, CVE-2026-13084 can be exploited by a remote unauthenticated attacker.