Techtimes Critical IKEv2 RCE Vulnerability in WatchGuard Firebox Devices Exploited
Article Content
- •CVE-2026-13368 allows unauthenticated remote code execution on Firebox devices.
- •Over 100,000 devices are exposed, with patches available for most models except legacy ones.
- •This is the third critical vulnerability in the same VPN daemon within ten months.
WatchGuard Technologies released patches on July 2, 2026, for a critical remote code execution vulnerability (CVE-2026-13368) affecting all supported Firebox firewall models. This flaw, linked to a race condition in the LDAP authentication path of the IKEv2 protocol, allows unauthenticated attackers to execute arbitrary code. It is the third critical vulnerability in the same VPN daemon discovered in ten months, with previous flaws leading to active exploitation. Over 100,000 devices are at risk, particularly those configured to use external LDAP for Mobile User VPN authentication. Patches are available for most models, but legacy T15 and T35 models remain unpatched. Administrators are urged to apply updates immediately due to the high risk of exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CISA and CVE-2025-14733 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…