A critical integer underflow vulnerability in WatchGuard Fireware OS allows remote, unauthenticated attackers to crash VPN services, leading to significant network availability risks.

This is an integer underflow flaw (CWE-191) residing in the iked process. It allows an unauthenticated remote attacker to disrupt VPN operations by sending specially crafted network packets to the affected device.

The vulnerability carries a CVSS score of 8.7, reflecting its high potential for service disruption. Successful exploitation results in a Denial of Service condition, which can disable secure remote access for employees and branch offices, causing immediate operational downtime and potential loss of productivity.

Immediate Action: Update Fireware OS to version 2026.2.2, 12.12.2, or 12.5.20 as applicable to your specific deployment.

Proactive Monitoring: Monitor VPN gateway logs for repeated connection failures or unusual traffic spikes targeting the iked process that may precede a service crash.

Compensating Controls: Restrict inbound access to VPN management and service ports to known, trusted IP addresses using access control lists to reduce the attack surface.

Public Exploit Available: No

Given the high CVSS severity and the critical role of VPN gateways in infrastructure, this vulnerability presents a significant availability risk. Security teams should prioritize patching affected Fireware OS devices during the next maintenance window to prevent potential service outages caused by malicious actors.