CVE-2026-13368: WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication

Synopsis

A race condition leading to a use-after-free vulnerability exists in WatchGuard Fireware OS within the LDAP authentication handler for Mobile VPN with IKEv2. The flaw is reachable over the network by an unauthenticated remote attacker, but exploitation requires winning a race condition and a specific prerequisite configuration (the Firebox must have Mobile VPN with IKEv2 configured to use an external LDAP server). Successful exploitation allows the attacker to execute arbitrary code in the context of the iked process on the targeted Firebox. Patched-image rebuilds at versions 12.0 and 12.5 are available on HarborGuard for environments running affected Fireware OS versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Firebox IKEv2 VPN endpoint over the network; the vulnerable code path is exposed on any Firebox with Mobile VPN with IKEv2 enabled and reachable from an external network.

• AuthenticationNot required

  No credentials are needed; the vulnerability is exploitable by a remote unauthenticated attacker prior to any login step.

• Victim interactionNot required

  No action by an administrator or user is required to trigger exploitation; the attacker interacts directly with the iked service.

• Attack complexityDetail

  Exploitation is rated High complexity (AC:H with AT:P), meaning the attacker must win a race condition and the target Firebox must be specifically configured to use an external LDAP authentication server for IKEv2, introducing meaningful but not insurmountable environmental requirements.

Blast Radius

• A successful attacker achieves arbitrary code execution in the context of the iked process, which handles VPN key exchange and session management on the Firebox.
• The attacker can read sensitive data processed by the iked process, including negotiated session keys, user identity material passed through LDAP, and in-memory authentication state (VC:H).
• The attacker can modify or corrupt iked process state, enabling manipulation of active VPN sessions or injection of attacker-controlled routing or authentication decisions (VI:H).
• The iked process can be crashed or destabilized, disrupting Mobile VPN connectivity for all IKEv2 users on the affected Firebox (VA:H).