Posted on

WatchGuard Fireware OS – Critical Pre-Authentication IKE Remote Code Execution

Threat Overview

WatchGuard published Fireware OS security updates on August 27, 2026 addressing multiple vulnerabilities, including three critical remote-code-execution flaws in iked, the Fireware Internet Key Exchange daemon used for IPsec VPN negotiations.

The highlighted IKE vulnerabilities are CVE-2026-19313, a pre-authentication heap buffer overflow; CVE-2026-19318, a pre-authentication stack buffer overflow; and CVE-2026-19315, a pre-authentication type-confusion issue with possible memory corruption and remote code execution. The vendor states specially crafted network traffic can trigger the critical issues without authentication.

WatchGuard states it is not aware of exploitation in the wild. This makes the issue primarily an urgent patch and exposure-review item, but the pre-authentication attack surface on perimeter VPN infrastructure warrants targeted hunting for unusual IKE activity and daemon instability.

References

Impacted Systems

  • Vendor/product: WatchGuard Firebox running Fireware OS.
  • Component: iked, the IKE/IPsec VPN daemon.
  • Critical CVEs: CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318.
  • Affected default Fireware ranges: 2025.0 through versions before 2026.2.2, and 12.0 through versions before 12.12.2.
  • T15/T35 affected range: 12.0 through versions before 12.5.20.
  • Fixed versions: Fireware OS 2026.2.2, 12.12.2, and 12.5.20 or later as applicable.
  • Relevant exposure: attacker-reachable IKE/IPsec VPN functionality, commonly UDP 500 and UDP 4500.
  • Attacker prerequisite: no authentication required for the critical iked issues.
  • Exploitation status: WatchGuard states it is not aware of exploitation in the wild.

Why this matters

These flaws affect perimeter VPN infrastructure and can be triggered before authentication. Remote code execution on an edge security appliance can provide a high-value foothold with limited endpoint visibility, so vulnerable Internet-reachable Fireboxes should be patched quickly.

Exploitation Status

No confirmed exploitation identified by WatchGuard. No reliable exploit-specific request signature should be assumed. Hunting should focus on exposure, unusual IKE traffic, and device instability rather than invented packet patterns.

What this hunt looks for

Inbound IKE traffic to exposed gateways, newly seen external sources, high-rate IKE activity, iked crash or restart indicators, repeated negotiation failures, and unusual edge-device network behavior after suspicious IKE traffic.

Required logs

  • CommonSecurityLog or equivalent firewall/network-security telemetry
  • Syslog from WatchGuard Firebox where available

Hunt 1 – First-Pass: Inbound IKE Traffic to WatchGuard-Relevant Ports

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Protocol =~ "UDP"
| where DestinationPort in (500,4500)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SourceIPs=dcount(SourceIP), SampleSources=make_set(SourceIP,30), Actions=make_set(DeviceAction,20) by DestinationIP, DestinationPort
| sort by Connections desc

Hunt 2 – New External Sources Reaching IKE Services

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where Protocol =~ "UDP"
| where DestinationPort in (500,4500)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where Protocol =~ "UDP"
| where DestinationPort in (500,4500)
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| sort by FirstSeen desc

Hunt 3 – High-Rate IKE Activity From a Single Source

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Protocol =~ "UDP"
| where DestinationPort in (500,4500)
| summarize Events=count(), Destinations=dcount(DestinationIP), Actions=make_set(DeviceAction,20) by SourceIP, bin(TimeGenerated,5m)
| where Events >= 100 or Destinations >= 5
| sort by Events desc

Hunt 4 – WatchGuard Syslog iked Crash or Restart Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has "iked" or SyslogMessage has "iked"
| where SyslogMessage has_any ("crash","segfault","terminated","restart","respawn","core","error","invalid","EAP","IKE_AUTH")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 5 – IKE Activity Followed by New Outbound Sessions From the Edge IP

let IKE = CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Protocol =~ "UDP" and DestinationPort in (500,4500)
| project IKETime=TimeGenerated, EdgeIP=DestinationIP, ExternalSource=SourceIP;
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| join kind=inner IKE on $left.SourceIP == $right.EdgeIP
| where TimeGenerated between (IKETime .. IKETime + 10m)
| where DestinationPort !in (500,4500)
| project IKETime, TimeGenerated, EdgeIP, ExternalSource, DestinationIP, DestinationPort, Protocol, DeviceAction, Message
| sort by IKETime asc

Hunt 6 – IKE Traffic Bursts Against Individual Gateways

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Protocol =~ "UDP" and DestinationPort in (500,4500)
| summarize IKEEvents=count(), Sources=dcount(SourceIP), SampleSources=make_set(SourceIP,20), Actions=make_set(DeviceAction,20) by DestinationIP, bin(TimeGenerated,5m)
| where IKEEvents >= 50
| sort by TimeGenerated desc

Hunt 7 – Syslog for Repeated VPN Negotiation Failures

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("IKE","IPsec","iked")
| where SyslogMessage has_any ("failed","invalid","error","malformed","EAP","authentication","proposal")
| summarize Events=count(), Samples=make_set(SyslogMessage,20) by Computer, HostIP, bin(TimeGenerated,5m)
| where Events >= 20
| sort by Events desc

Detection Notes

  • No reliable exploit-specific network signature was published by WatchGuard, so these hunts do not assume an unsupported malformed-packet pattern.
  • UDP 500 and 4500 are normal on VPN gateways. Scope to confirmed WatchGuard Firebox addresses where possible.
  • iked crash or restart events following unusual IKE traffic are higher signal than raw IKE volume.
  • High-rate IKE activity can overlap with scanners, misconfigured peers, or legitimate reconnect storms.
  • CommonSecurityLog field mappings vary by firewall connector.
  • Without Firebox Syslog or network-security telemetry that identifies the targeted device, Sentinel visibility into exploit attempts may be limited.

Leave a comment