high8.1
CVE-2026-13368
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2.
Impact
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Watchguard | Fireware | from 2025.1 before 2026.2.1 from 12.5 before 12.5.19 from 11.0.0 before 11.12.4 from 12.0 before 12.12.1 Version 11.12.4 |