Vulnerability · Published Jul 2, 2026 · Assigned by WatchGuard
CVE-2026-13084Null Pointer Dereference in WatchGuard Fireware OS iked Process
High 8.7
In plain English
A high-severity null pointer dereference in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WatchGuard | Fireware OS | 2025.1 – before 2026.2.112.0 – before 12.12.111.10.2 – before * |
| WatchGuard | Fireware OS | 12.0 – before 12.11.9 |
| WatchGuard | Fireware OS | 12.0 – before 12.5.19 |
Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://psirt.watchguard.com/CVE-2026-13084 vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00024 vendor-advisory