WatchGuard released three Fireware OS branches on August 27, 2026 to fix 11 security flaws, including four critical vulnerabilities rated 9.3. The company is telling customers and service providers to update every owned, managed, and client-operated Firebox immediately. The fixed versions are Fireware 2026.2.2, 12.12.2, and 12.5.20 for the older T15/T35 branch [1].
The most important boundary is that WatchGuard has not seen evidence of exploitation in the wild. That does not make the update optional: several flaws reach the IKE daemon before authentication, while another can give root code execution through a deprecated Mobile Security service from a trusted interface. A vulnerable version proves exposure to defective code, not that a Firebox was compromised.
Which WatchGuard Firebox versions are affected?
| Fireware branch | Affected and fixed versions |
|---|---|
| Current default branch | Fireware OS 2025.0 through versions below 2026.2.2 are affected. Install 2026.2.2 or later. |
| 12.x default branch | Fireware OS 12.0 through versions below 12.12.2 are affected. Install 12.12.2 or later. |
| T15 and T35 appliances | Fireware OS 12.0 through versions below 12.5.20 are affected. Install 12.5.20 or later. |
Do not infer safety from a disabled management Web UI alone. Most of the newly disclosed issues affect iked, the service that handles IKE and IPsec VPN traffic. One separate flaw affects epm, and another affects wgagent. Exposure depends on the service, interface, configuration, and CVE—not only whether the administrator page is public.
Four critical RCE paths need different checks
- CVE-2026-19313: WatchGuard describes a pre-authentication heap overflow in
iked. Crafted network traffic can crash the process, and attacker-controlled data written beyond the allocated buffer creates potential for remote code execution [2]. - CVE-2026-19315: two EAP payloads in a crafted
IKE_AUTHmessage can trigger type confusion, an invalid-pointer free, and anikedcrash. The detailed impact describes potential memory corruption and RCE beyond denial of service [3]. - CVE-2026-19318: an undersized length in an EAP-MSCHAPv2 payload can overflow a stack buffer after
IKE_SA_INIT. This path requires IKE payload diagnostic logging to be enabled; disabling that troubleshooting option narrows this CVE but does not fix the other flaws [4]. - CVE-2026-13086: the deprecated Mobile Security feature exposes an
epmJSON-RPC service. A network-adjacent attacker who can reach it through a trusted interface can overwrite a return address and run code as root without authentication [5].
The same firmware also fixes seven high-severity issues: CVE-2026-19314, CVE-2026-19316, CVE-2026-19317, CVE-2026-78008, CVE-2026-78009, CVE-2026-78010, and CVE-2026-78011. Most can disrupt IKE/IPsec VPN processing or another Fireware service; some detailed advisories discuss additional memory-corruption possibilities without confirming RCE.
What Firebox administrators should do now
- Inventory the actual branch and appliance model. Record each Firebox version before the maintenance window. T15/T35 devices use the 12.5.20 fixed branch; do not copy a version number from a different model family.
- Back up the configuration and install the vendor release. Obtain 2026.2.2, 12.12.2, or 12.5.20 from WatchGuard Cloud, the Firebox Web UI, or the official Software Downloads Center. Follow the release notes for the exact appliance and high-availability design.
- Verify the result after reboot. Confirm the running version rather than relying on a completed download or queued upgrade. Test Branch Office VPN, Mobile VPN with IKEv2, and other production IPsec paths.
- Check the two configuration-specific paths. Identify any appliance that still uses the deprecated Mobile Security feature, and check whether IKE payload diagnostic logging was enabled for troubleshooting. These findings change exposure analysis but do not replace the firmware update.
- Review the pre-update window. Look for repeated
iked,epm, orwgagentcrashes and respawns, unexpected configuration or administrator changes, abnormal VPN failures, and unusual outbound connections. WatchGuard has not published a universal exploit IOC, so a clean keyword search cannot prove that the device was never targeted. - Escalate suspicious devices as incidents. Preserve logs and configuration, restrict network access, revoke suspect sessions, rotate privileged credentials from a known-clean system, and rebuild trust before returning a confirmed-compromised edge device to service.
The response logic is similar to other exposed VPN gateways: patch status and incident status answer different questions. Gridinsoft’s coverage of CVE-2026-33824 on Windows IKE VPN endpoints explains why UDP 500/4500 reachability matters, while the Citrix NetScaler response guide shows why an edge-device update should be followed by evidence review when exposure existed.
References
- WatchGuard Technologies. “Immediate Action Required — Update Your Firebox Now.” WatchGuard Product and Support News, August 27, 2026. Firmware releases and 11-CVE notice.
- WatchGuard PSIRT. “CVE-2026-19313 — Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution.” Published August 27, 2026. Affected versions and impact.
- WatchGuard PSIRT. “CVE-2026-19315 — Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution.” Published August 27, 2026. IKE_AUTH condition and impact.
- WatchGuard PSIRT. “CVE-2026-19318 — Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution.” Published August 27, 2026. Diagnostic-logging condition.
- WatchGuard PSIRT. “CVE-2026-13086 — Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint.” Published August 27, 2026. Trusted-interface root RCE path.
