CVE-2026-81851 - Vulnerability Details - OpenCVE

A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Watchguard	Fireware Os

No data.

No data.

References

Link	Providers
https://psirt.watchguard.com/CVE-2026-81851

History

Fri, 28 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Description		A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
Title		Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service
First Time appeared		Watchguard Watchguard fireware Os
Weaknesses		CWE-122 CWE-1284
CPEs		cpe:2.3:a:watchguard:fireware_os::::::::
Vendors & Products		Watchguard Watchguard fireware Os
References		https://psirt.watchguard.com/CVE-2026-81851
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2026-08-27T22:58:26.855Z

Updated: 2026-08-28T15:57:26.539Z

Reserved: 2026-08-27T16:29:07.182Z

Link: CVE-2026-81851

Vulnrichment

Updated: 2026-08-28T14:33:10.264Z

NVD

Status : Deferred

Published: 2026-08-28T00:18:22.687

Modified: 2026-08-28T20:20:14.080

Link: CVE-2026-81851

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81851", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-08-27T16:29:07.182Z", "datePublished": "2026-08-27T22:58:26.855Z", "dateUpdated": "2026-08-28T15:57:26.539Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-27T22:58:26.855Z"}, "title": "Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service", "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration."}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.0", "versionType": "custom", "lessThan": "2026.2.1"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.12.1"}], "defaultStatus": "unaffected", "platforms": ["Default"]}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.11.9"}], "defaultStatus": "unaffected", "platforms": ["EUCC"]}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.5.18"}], "defaultStatus": "unaffected", "platforms": ["T15/T35"]}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-81851", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.11.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.5.18"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.0", "versionEndExcluding": "2026.2.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.12.1"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122", "type": "CWE", "cweId": "CWE-122"}, {"lang": "en", "description": "CWE-1284", "type": "CWE", "cweId": "CWE-1284"}]}], "credits": [{"lang": "en", "value": "Cody Sixteen", "type": "finder"}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.11.9, Fireware OS 12.5.18", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.11.9, Fireware OS 12.5.18</p>"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-28T14:33:09.128484Z", "id": "CVE-2026-81851", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T15:57:26.539Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81851", "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "state": "PUBLISHED", "assignerShortName": "WatchGuard", "dateReserved": "2026-08-27T16:29:07.182Z", "datePublished": "2026-08-27T22:58:26.855Z", "dateUpdated": "2026-08-28T15:57:26.539Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "shortName": "WatchGuard", "dateUpdated": "2026-08-27T22:58:26.855Z"}, "title": "Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service", "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration."}], "affected": [{"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "2025.0", "versionType": "custom", "lessThan": "2026.2.1"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.12.1"}], "defaultStatus": "unaffected", "platforms": ["Default"]}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.11.9"}], "defaultStatus": "unaffected", "platforms": ["EUCC"]}, {"vendor": "WatchGuard", "product": "Fireware OS", "versions": [{"status": "affected", "version": "12.0", "versionType": "custom", "lessThan": "12.5.18"}], "defaultStatus": "unaffected", "platforms": ["T15/T35"]}], "references": [{"url": "https://psirt.watchguard.com/CVE-2026-81851", "tags": ["vendor-advisory"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.11.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.5.18"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.0", "versionEndExcluding": "2026.2.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0", "versionEndExcluding": "12.12.1"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122", "type": "CWE", "cweId": "CWE-122"}, {"lang": "en", "description": "CWE-1284", "type": "CWE", "cweId": "CWE-1284"}]}], "credits": [{"lang": "en", "value": "Cody Sixteen", "type": "finder"}], "solutions": [{"lang": "en", "value": "Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.11.9, Fireware OS 12.5.18", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.11.9, Fireware OS 12.5.18</p>"}]}], "exploits": [{"lang": "en", "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T14:33:09.128484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T14:33:10.264Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Default"], "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThan": "2026.2.1", "status": "affected", "version": "2025.0", "versionType": "custom"}, {"lessThan": "12.12.1", "status": "affected", "version": "12.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["EUCC"], "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThan": "12.11.9", "status": "affected", "version": "12.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["T15/T35"], "product": "Fireware OS", "vendor": "WatchGuard", "versions": [{"lessThan": "12.5.18", "status": "affected", "version": "12.0", "versionType": "custom"}]}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration."}], "id": "CVE-2026-81851", "lastModified": "2026-08-28T20:20:14.080", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81851", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-28T14:33:09.128484Z", "version": "2.0.3"}}]}, "published": "2026-08-28T00:18:22.687", "references": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "url": "https://psirt.watchguard.com/CVE-2026-81851"}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-1284"}], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary"}]}