CVE-2026-78010

A stack-based buffer overflow (CWE-121, with out-of-bounds write and improper input-length validation) exists in the iked process of WatchGuard's Fireware OS. A remote, unauthenticated attacker can trigger it by sending specially crafted network traffic to the appliance's IKE/VPN processing, causing a denial-of-service condition in VPN handling. The impact is availability only — CVSS 4.0 scores confidentiality and integrity impact as none — so current scoring indicates no data exposure or code execution from this flaw. Any organization running a WatchGuard Firebox/firewall on an affected Fireware OS release with IKE-based VPN processing enabled is affected; the provided data does not specify affected version ranges. The flaw is not currently known to be exploited: EPSS is 0.3% (26th percentile), it is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Fireware OS to the fixed release cited in WatchGuard's advisory (no version numbers appear in the current data, so confirm affected and fixed versions there). As an interim mitigation, restrict IKEv2/IPsec endpoint exposure to trusted source addresses or disable IKEv2 Mobile VPN where it is not needed, and watch for VPN service (iked) restarts or unavailability that would indicate attempted exploitation.