PSIRT WatchGuard CVE-2026-19318

psirt.watchguard.com • August 29, 2026

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

Impact: An unauthenticated remote attacker who completes IKE_SA_INIT can send a specially crafted IKE_AUTH message containing an EAP-MSCHAPv2 payload with an undersized embedded length field, triggering a stack buffer overflow in the iked process. This causes a crash and denial-of-service condition (with automatic respawn), and given the attacker-influenced nature of the stack overwrite, may carry potential for remote code execution. Exploitation requires that IKE payload diagnostic logging, a supported operational troubleshooting setting, be enabled on the affected device.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Fireware OS Require Immediate Patching Multiple critical vulnerabilities have been identified in WatchGuard Fireware OS and WatchGuard Dimension, with CVSS scores of 9.3. These include CVE-2026-19318, a stack-based buffer overflow in the iked process, allowing remote unauthenticated attackers to execute arbitrary code via crafted network traffic. Other vulnerabilities include CVE-2026-19315 (type confusion) and CVE-2026-19313 (heap overflow), both also enabling remote code execution. Additionally, CVE-2026-78174 allows low-privileged admins to hijack high-privileged accounts. No confirmed exploitation has been reported, but organizations are urged to apply patches immediately. The vulnerabilities affect devices running Fireware OS and Dimension, which are critical for network security. WatchGuard recommends restricting access to affected services until patches are applied. 17 sources 61

Extracted Entities

PSIRT WatchGuard CVE-2026-19318

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)