Loading vulnerability…
Unauthenticated RCE in WatchGuard Firebox IKE Service
CVE-2025-32978 is a critical remote code execution vulnerability in WatchGuard Firebox firewalls affecting the Fireware OS Internet Key Exchange (IKE) service. According to the provided content, the flaw allows unauthenticated remote attackers to execute arbitrary commands on vulnerable devices. The issue affects deployments using IKEv2, including mobile user VPN and branch office VPN configurations with dynamic gateway peers; the content also notes that some devices may remain vulnerable even after certain VPN configurations were deleted, depending on remaining static gateway peer configurations. The vulnerability has been reported as actively exploited in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the firewall and potentially take full control of the device. Given the role of Firebox as a perimeter security appliance, compromise can enable loss of integrity and availability of the firewall itself, interception or manipulation of network traffic, disabling of security controls, persistence on a highly privileged edge device, and use of the appliance as a foothold for further intrusion into the protected environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, implement WatchGuard's temporary workaround referenced in the provided content. In addition, reduce exposure of the vulnerable IKE service wherever operationally feasible, especially on internet-reachable devices, and monitor for the published indicators of compromise until remediation is complete. Because the content indicates active exploitation, organizations should assume elevated risk for exposed vulnerable appliances.
Patch, then assume compromise.
Apply the WatchGuard firmware updates that fully address CVE-2025-32978. Because the vulnerability is under active exploitation, patching should be treated as urgent. Validate that all affected Firebox devices are updated, including systems with current or historical IKEv2-based VPN configurations, and review WatchGuard-provided indicators of compromise to determine whether exploitation has already occurred.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.