CVE-2026-13368 is a critical use-after-free vulnerability (CWE-416) in WatchGuard Fireware OS caused by a race condition in the LDAP authentication mechanism for Mobile User VPN with IKEv2. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code within the iked process context on Fireboxes configured to use an external LDAP authentication server. The vulnerability affects Fireware OS versions 11.0 up to 11.12.4_Update1, 12.0 up to 12.12, and 2025.1 up to 2026.2. No official remediation or patch information is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on the vulnerable Firebox device with the privileges of the iked process. This compromises the integrity and potentially the availability of the affected system, particularly those using Mobile VPN with IKEv2 and external LDAP authentication. The critical CVSS score reflects the high impact and remote attack vector without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider disabling Mobile User VPN with IKEv2 LDAP authentication if feasible or apply compensating controls such as restricting network access to the VPN service. Monitor WatchGuard advisories closely for updates and patches addressing this vulnerability.