CVE-2026-19315: CWE-125 in WatchGuard Fireware OS

This vulnerability involves a type confusion flaw (CWE-125) in the iked process of WatchGuard Fireware OS. An attacker can remotely send crafted network packets to trigger arbitrary code execution without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions explicitly include =2025.0, =12.0, and =2026.3. No patch or official remediation level has been disclosed by WatchGuard as of the publication date.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on affected Fireware OS devices, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor WatchGuard advisories closely and consider limiting network exposure of the iked process until a patch is available.