125,000+ Firebox IPs Found Exposed — Critical IKEv2 RCE in the Wild

What the flaw is and where it lives

The issue is an out-of-bounds write in the iked process—the component responsible for IKEv2 VPN key exchange in Fireware OS. If exploited, the vulnerability can allow a remote, unauthenticated attacker to execute arbitrary code on an affected appliance. Both mobile user VPNs that use IKEv2 and branch-office VPN configurations using IKEv2 with dynamic gateway peers are implicated. These technical details are reflected in vendor and vulnerability database records.

Severity and consensus on impact

WatchGuard has classified the issue as critical and released fixed Fireware builds. WatchGuard’s advisory attributes a high CVSS severity, and the NVD/CNA entries list the flaw as allowing unauthenticated remote code execution — a near-worst-case outcome for an edge networking product. Federal agencies have also been notified: the vulnerability was added to the U.S. Known Exploited Vulnerabilities catalog, which shortens remediation timelines for affected organizations.

Who’s affected and the recommended upgrades

Multiple Fireware OS branches are affected. Vendor guidance and NVD records list impacted releases within the 2025.x, 12.x, and certain 11.x ranges and map them to the resolved versions WatchGuard has published. Administrators are advised to validate appliance models and installed Fireware builds and to apply the vendor-provided updates immediately where available. For end-of-life branches that will not receive fixes, organizations should plan rapid replacement or network isolation.

Indicators to look for and immediate controls

WatchGuard has published indicators of attack and guidance for detecting suspicious IKE traffic; defenders should search for unusually large IKE_AUTH payloads, certificate chain anomalies, and other IKE negotiation irregularities in firewall logs. Given that active exploitation has been observed, the practical priorities are straightforward: confirm inventory, apply vendor fixes, and monitor for the IoAs WatchGuard provided. If you suspect compromise, treat the appliance as potentially breached: isolate it, preserve logs, rotate locally stored credentials, and follow incident-response procedures.

Final note

This incident is a reminder that gateways remain a prime target: an unauthenticated RCE in a firewall VPN stack is high-impact by design. The combination of a remotely exploitable IKEv2 parsing bug, active scanning results showing many internet-reachable appliances, and confirmed exploitation elevates urgency from advisable to mandatory. Organizations that still expose management or VPN-terminating appliances directly to the internet should treat this as a catalyzing event to accelerate patching, inventory hygiene, and segmentation.