Skip to content
OpenAdvisories
High WID-SEC-2026-3068 12 CVEs

WatchGuard Firebox OS: Mehrere Schwachstellen

Published Aug 27, 2026 · Updated Sep 9, 2026 · Revision 2 · de-DE

Vendor: WatchGuard Product: Firebox

Summary

Ein Angreifer kann mehrere Schwachstellen in WatchGuard Firebox OS ausnutzen, um beliebigen Code – einschließlich Code mit Root-Rechten – auszuführen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.

Vulnerabilities 12

  • Critical 9.3
    CVE-2026-13086

    Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint

    A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

    WatchGuard Fireware OS
  • Critical 9.3
    CVE-2026-19313

    Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution

    An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • Critical 9.3
    CVE-2026-19315

    Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

    A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • Critical 9.3
    CVE-2026-19318

    Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution

    A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-19314

    Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)

    An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-19316

    Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)

    A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-19317

    Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)

    An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-78009

    Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)

    An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-78010

    Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service

    A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.7
    CVE-2026-78011

    Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)

    An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

    WatchGuard Fireware OS
  • High 8.6
    CVE-2026-78008

    Fireware OS Authenticated Buffer Overflow in wgagent

    A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network t…

    WatchGuard Fireware OS
  • Medium 6.9
    CVE-2026-81851

    Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service

    A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.

    WatchGuard Fireware OS

Revision history

  1. #2

    Referenz(en) aufgenommen: ZDI-26-632, ZDI-CAN-30460

  2. #1

    Initiale Fassung

References