Denial‑of‑Service Vulnerability (CVE‑2026‑13084) in WatchGuard FireWare OS IKEv2 Could Disrupt VPN Services
What It Is — WatchGuard disclosed a null‑pointer dereference in the IKEv2 IKE_AUTH handling of its FireWare OS. The flaw can be triggered by crafted IKEv2 packets, causing the VPN service to crash. No authentication is required, but only installations that expose IKEv2 VPN endpoints are vulnerable.
Exploitability — The vulnerability is remotely exploitable (AV:N) with a high attack complexity (AC:H). No user interaction is needed, and the impact is a denial‑of‑service (A:H). No public exploit code has been released, but the vendor has issued a patch. CVSS 5.9 (Moderate).
Affected Products — WatchGuard FireWare OS (any version that supports IKEv2 VPN).
Why It Matters for Compliance & Audit Readiness
- SOC 2 Control CC6.1 (System Operations) requires evidence that critical services remain available; an unpatched DoS flaw undermines that evidence.
- Continuous control monitoring must capture patch‑management status for network appliances; a missing patch creates a gap in your audit trail.
- Enterprise customers increasingly demand proof of timely remediation for known vulnerabilities as part of vendor‑risk assessments.
Recommended Actions
- Verify whether any of your VPN endpoints run WatchGuard FireWare OS with IKEv2 enabled.
- Apply the vendor‑supplied update (WGSA‑2026‑00024) immediately; document the patch as evidence of control CC6.1 compliance.
- Update your vulnerability‑management dashboard to flag CVE‑2026‑13084 and ensure continuous monitoring for future releases.