CVE-2026-13084

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.10.2 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.12 WatchGuard Fireware OS versions 2025.1 through 2026.2

Description A null pointer dereference occurs when the software attempts to read a memory location that is null, leading to a system crash. This issue allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. The flaw impacts the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.