A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.
This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
References
| Link | Resource |
|---|---|
| https://psirt.watchguard.com/CVE-2026-13084 | Broken Link |
| https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00024 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
No history.
Information
Published : 2026-07-03 00:16
Updated : 2026-08-28 00:16
NVD link : CVE-2026-13084
Mitre link : CVE-2026-13084
CVE.ORG link : CVE-2026-13084
JSON object : View
Products Affected
watchguard
- firebox_t25
- firebox_t85
- firebox_nv5
- firebox_m495
- firebox_m4600
- firebox_m5800
- firebox_t80
- fireware
- firebox_t20
- firebox_t70
- fireboxv
- firebox_m295
- firebox_m395
- firebox_cloud
- firebox_m390
- firebox_m470
- firebox_m695
- firebox_m270
- firebox_m5600
- firebox_m590
- firebox_t145-w
- firebox_t15
- firebox_t185
- firebox_t35
- firebox_t55
- firebox_m595
- firebox_m440
- firebox_t45
- firebox_m670
- firebox_t125-w
- firebox_m370
- firebox_t115-w
- firebox_t145
- firebox_m570
- firebox_t125
- firebox_m690
- firebox_t40
- firebox_m4800
- firebox_m290
CWE
CWE-476
NULL Pointer Dereference