Riskcovery

CVE-2026-19315

Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

State
Published
Severity
9.3 Critical
Published
Aug 27, 2026
Updated
Sep 3, 2026
Reserved
Aug 7, 2026

Read the record on cve.org

Description

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWatchGuard

Weaknesses

Affected Products

ProductVersions
Fireware OSWatchGuard
  • 2025.0 to before 2026.2.2Affected
  • 12.0 to before 12.12.2Affected
  • 2026.3 to before 2026.3.1Affected
Fireware OSWatchGuard
  • 12.0 to before 12.5.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.