ZDI-26-427: WatchGuard FireWare OS iked ike2_hmac Null Pointer Dereference Denial-of-Service Vulnerability
Published Jul 15, 2026
·Updated
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability, but only systems using VPN with IKEv2 are vulnerable. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-13084.
Affected Software
1 affected component
WatchGuard Fireware OS
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard FireWare OS (iked/ike2_hmac)to a version that resolves this vulnerability.Patch ZDI-26-427 - Compensating control
If you cannot patch immediately, limit exposure by ensuring only VPN systems using IKEv2 are reachable as required, since systems using VPN with IKEv2 are vulnerable.
Event History
Jul 15, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description