Null Pointer Dereference in WatchGuard Fireware OS

CVE-2026-13084

What is CVE-2026-13084?

A null pointer dereference vulnerability found in WatchGuard's Fireware OS can be exploited by remote unauthenticated attackers to trigger a denial-of-service (DoS) condition. This is achieved by sending specially crafted IKEv2 messages, affecting the Mobile User VPN and Branch Office VPN when configured with a dynamic gateway peer. The vulnerability is present in multiple versions of Fireware OS, leaving many systems open to potential disruption.

References