CVE-2026-19315

CVE-2026-19315 is a type confusion flaw (CWE-843, with associated out-of-bounds read CWE-125) in the iked process, the IKE daemon that handles IPsec VPN key exchange in WatchGuard Fireware OS. A remote, unauthenticated attacker can trigger the bug by sending specially crafted network traffic to the IKE service, typically reachable on UDP 500/4500. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 4.0 base score of 9.3, critical). Any organization running WatchGuard Firebox appliances with Fireware OS, particularly those exposing the IKE/VPN service to the internet, is potentially affected. There is no evidence of in-the-wild exploitation: no public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at only 0.5% (38th percentile).

What to do: Identify all WatchGuard Firebox appliances in your estate, determine whether iked/IKE is enabled and reachable from the internet, and apply the patched Fireware OS release specified in WatchGuard's advisory (exact version numbers are not provided in the available data). Until you can patch, restrict inbound IKE (UDP 500/4500) to trusted VPN peers where feasible and monitor the daemon for anomalous activity. Since no public PoC exists yet, prioritize internet-facing VPN endpoints and re-check vendor advisories as details firm up.