PSIRT WatchGuard CVE-2026-19313

psirt.watchguard.com • August 29, 2026

An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

Impact: An unauthenticated remote attacker can trigger a heap buffer overflow in the IKE daemon, causing a crash and denial of service, with the potential for remote code execution due to attacker-controlled data being written beyond the bounds of the allocated buffer.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Fireware OS Require Immediate Patching Multiple critical vulnerabilities have been identified in WatchGuard Fireware OS and WatchGuard Dimension, with CVSS scores of 9.3. These include CVE-2026-19318, a stack-based buffer overflow in the iked process, allowing remote unauthenticated attackers to execute arbitrary code via crafted network traffic. Other vulnerabilities include CVE-2026-19315 (type confusion) and CVE-2026-19313 (heap overflow), both also enabling remote code execution. Additionally, CVE-2026-78174 allows low-privileged admins to hijack high-privileged accounts. No confirmed exploitation has been reported, but organizations are urged to apply patches immediately. The vulnerabilities affect devices running Fireware OS and Dimension, which are critical for network security. WatchGuard recommends restricting access to affected services until patches are applied. 17 sources 61

Extracted Entities

PSIRT WatchGuard CVE-2026-19313

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)