Loading story…
A high-severity flaw tracked as CVE-2026-63089 affects WireGuard Easy (wg-easy) through version 15.3.0, allowing unauthenticated attackers to brute-force one-time-link tokens and retrieve sensitive VPN configuration data. The issue stems from token generation based on CRC32 over a random value limited to 0-999, leaving at most 1,000 possible tokens per client ID. Attackers can enumerate those tokens against the unauthenticated /cnf/:oneTimeLink route, which also lacked rate limiting and did not properly enforce token expiration.
Successful exploitation can disclose a peer's PrivateKey and PresharedKey, enabling an attacker to impersonate that WireGuard peer on the VPN network. The project addressed the issue in commit 66b292b11bde3664f05ffb016c8082665d261ded, which added expiration checks for one-time links, tightened authentication behavior, and documented the known brute-force weakness in the one-time-link design, including the limited mitigation provided by short validity windows and one-time use.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting WireGuard Easy through version 15.3.0 was disclosed as CVE-2026-63089, describing weak one-time link token generation that leaves at most 1000 candidates per client ID. The flaw allows unauthenticated attackers to brute-force tokens via the /cnf/:oneTimeLink route and recover a peer's PrivateKey and PresharedKey for VPN impersonation.
On June 12, 2026, the wg-easy project committed changes to validate one-time link expiration before use and documented known brute-force weaknesses in the one-time-link design. The commit is identified as the fix for the later-tracked WireGuard Easy token generation vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard released fixes for five **critical** vulnerabilities in Fireware OS and WatchGuard Dimension, all rated CVSS v4 9.3. Three flaws in the internet-exposed `iked` IKE/VPN daemon—including the pre-authentication stack buffer overflow tracked as `CVE-2026-19318`—could allow unauthenticated attackers to execute code by sending crafted VPN traffic, creating a direct perimeter-compromise risk. A fourth Fireware issue affects the deprecated Mobile Security `epm` service, while a WatchGuard Dimension vulnerability could let a low-privileged administrator hijack a Super Administrator session. WatchGuard reported no confirmed exploitation or public proof-of-concept code, but organizations should apply the available updates immediately; where patching is delayed, VPN and management interfaces should be limited to trusted networks.
Sep 1, 2026
A critical security vulnerability, tracked as CVE-2025-9242, was discovered in WatchGuard Fireware OS, which powers WatchGuard’s Firebox network security appliances. This flaw is an out-of-bounds write vulnerability in the iked process, specifically within the function 'ike2_ProcessPayload_CERT' in the file 'src/ike/iked/v2/ike2_payload_cert.c'. The vulnerability arises due to a missing length check on the identification buffer, allowing a remote, unauthenticated attacker to trigger a stack-based buffer overflow. Exploitation of this flaw enables arbitrary code execution during the IKE_SA_AUTH phase of the IKEv2 handshake, which is used to establish VPN tunnels. The vulnerability affects both mobile user VPNs and branch office VPNs configured with dynamic gateway peers, making it a significant risk for organizations relying on these features. Fireware OS versions 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3, and 2025.1 are impacted, with fixes released in 2025.1.1, 12.11.4, 12.3.1_Update3 (FIPS-certified), and 12.5.13 for specific models. The 11.x branch has reached end-of-life and is no longer supported. Security researchers, including McCaulay Hudson of watchTowr Labs, highlighted that the vulnerability is particularly attractive to ransomware groups due to its remote, unauthenticated nature and the fact that it targets internet-exposed perimeter appliances. WatchGuard’s Fireware OS is widely deployed, protecting over 250,000 small and midsize enterprises and more than 10 million endpoints globally, amplifying the potential impact of this vulnerability. The flaw was disclosed and patched following responsible disclosure, with WatchGuard issuing an advisory and urging customers to update affected devices immediately. The vulnerability underscores the ongoing risk posed by classic buffer overflow issues, even in modern enterprise-grade security appliances. Researchers were able to reproduce the exploit, demonstrating the ease with which attackers could compromise vulnerable systems. The lack of mainstream exploit mitigations in the affected code path further increases the risk of successful exploitation. Organizations using WatchGuard Fireware OS are advised to review their VPN configurations, apply the latest patches, and consider additional monitoring for signs of exploitation. The incident highlights the importance of timely patch management and the persistent threat posed by memory safety vulnerabilities in critical infrastructure.
Jun 29, 2026
A high-severity flaw in **OpenClaw** (also known as *Clawdbot* / *Moltbot*) enables **one-click remote code execution (RCE)** by abusing how the Control UI auto-connects to a gateway specified via a crafted URL. The issue is tracked as **CVE-2026-25253** (CVSS **8.8**) and was fixed in **OpenClaw 2026.1.29**; the core weakness is that the UI trusts `gatewayUrl` from the query string and sends a stored gateway token in the WebSocket connection payload, allowing **token exfiltration** to an attacker-controlled server. With the stolen token, an attacker can connect to the victim’s local gateway and perform privileged actions—such as modifying configuration (e.g., sandbox/tool policies) and invoking privileged operations—resulting in **full gateway compromise** and RCE. Separate reporting also highlights architectural risk in OpenClaw’s local WebSocket-based Chrome orchestration, noting that (prior to patching) unauthenticated connections could be initiated from JavaScript running in a user’s browser, enabling cross-tab/session credential theft; users are advised to **patch immediately** and be cautious about deployment given ongoing security concerns.
Jun 29, 2026