PSIRT WatchGuard CVE-2026-19315

psirt.watchguard.com • August 29, 2026

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

Impact: A remote, unauthenticated attacker can send a specially crafted IKE_AUTH message containing two EAP payloads to crash the IKE daemon (iked), causing a denial-of-service condition through process termination and respawn. Because the flaw results in an out-of-bounds read followed by a free() call on an attacker-influenced pointer value, it may also present potential for further memory corruption and remote code execution beyond denial of service.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Fireware OS Require Immediate Patching Multiple critical vulnerabilities have been identified in WatchGuard Fireware OS and WatchGuard Dimension, with CVSS scores of 9.3. These include CVE-2026-19318, a stack-based buffer overflow in the iked process, allowing remote unauthenticated attackers to execute arbitrary code via crafted network traffic. Other vulnerabilities include CVE-2026-19315 (type confusion) and CVE-2026-19313 (heap overflow), both also enabling remote code execution. Additionally, CVE-2026-78174 allows low-privileged admins to hijack high-privileged accounts. No confirmed exploitation has been reported, but organizations are urged to apply patches immediately. The vulnerabilities affect devices running Fireware OS and Dimension, which are critical for network security. WatchGuard recommends restricting access to affected services until patches are applied. 17 sources 61

Extracted Entities

PSIRT WatchGuard CVE-2026-19315

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (1)

CWE Weaknesses (3)

MITRE ATT&CK (1)

Platforms (1)