External risk intelligence

WatchGuard Fireware OS LDAP Authentication Race Condition Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-13368

The vulnerability affects a Mobile VPN with IKEv2 service on a firewall. Such services are explicitly designed to be internet-facing to facilitate remote access and are typically exposed on the network edge to accept connections from external clients.

Use After Free

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within WatchGuard's Fireware OS, specifically affecting its Mobile User VPN feature when configured with external LDAP authentication. The flaw could allow an unauthenticated attacker to execute arbitrary code on affected devices. The main concern is confirming relevance and exposure for firewalls with this specific VPN configuration.

Race condition in VPN authentication.
Critical if remote access uses external LDAP.
Confirm VPN configuration and exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker can leverage a use-after-free flaw in the VPN's LDAP authentication to compromise the firewall's operating system. This attack targets Fireboxes configured for Mobile User VPN with IKEv2 and an external LDAP server. By exploiting this race condition, an attacker could execute arbitrary code with the privileges of the VPN process.

Entry condition: VPN service exposed externally.
Trigger point: LDAP authentication in Mobile VPN.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A race condition in LDAP authentication for Mobile User VPN with IKEv2 could allow an unauthenticated attacker to execute arbitrary code on Fireboxes configured for external LDAP authentication. This could impact the integrity and availability of the VPN service.

Firebox system code integrity.
Remote unauthenticated attacker execution.
Compromise of VPN authentication service.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, the infrastructure or network security teams responsible for managing WatchGuard Fireboxes are likely to own this vulnerability. Initial triage should focus on identifying all Fireboxes with the Mobile VPN and IKEv2 service enabled, confirming their exposure to the internet, and determining if they are business-critical. This information will guide the prioritization of remediation efforts, which may involve vendor coordination or planning for maintenance windows.

Owner: Network infrastructure and security teams.
Verify: Identify and confirm exposed Fireboxes.
Action: Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WatchGuard Fireware OS?

WatchGuard Fireware OS is the underlying software that powers WatchGuard Firebox appliances. These devices serve as network security gateways, providing firewall protection, VPN connectivity, and traffic filtering to secure organizational networks. The OS manages essential processes, such as the iked process, which handles the complex tasks involved in establishing secure virtual private network tunnels for remote users.

What does CWE-416 mean for CVE-2026-13368?

CWE-416 refers to a Use-After-Free vulnerability. In this context, the Fireware OS experiences a race condition when handling LDAP authentication for Mobile User VPNs. Because the system attempts to access a memory location after it has already been freed, the process becomes unstable. An attacker can manipulate this timing to inject their own instructions, potentially leading to unauthorized arbitrary code execution within the VPN authentication service.

How is this vulnerability triggered?

The flaw is triggered during the authentication handshake for a Mobile VPN using IKEv2 that points to an external LDAP server. The race condition occurs specifically within the authentication flow. It is important to note that if a device does not use IKEv2 for Mobile VPN or relies solely on internal authentication mechanisms rather than an external LDAP server, this specific trigger path is not applicable.

Why is this CVE considered relevant for my network?

Halo Surface Signal classifies this as high priority because it targets a Mobile VPN service. Since VPNs are designed to accept incoming connections from remote clients, they are typically exposed to the internet. If your Firebox is configured with IKEv2 and external LDAP, it is reachable by remote, unauthenticated attackers who could potentially exploit the authentication process to compromise the device.

Do I need to take immediate action?

Start by identifying all Firebox appliances in your environment that have the Mobile VPN with IKEv2 feature enabled. Verify whether these specific instances are configured to use an external LDAP server for authentication. Once you have a clear inventory of affected, internet-facing devices, coordinate with your network security team to prioritize them for vendor-supplied updates or security maintenance windows.

References

www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00023

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.