Ransomware gangs now exploit the unauthenticated IKEv2 RCE in WatchGuard Firebox firewalls

CISA updated its KEV entry on September 10, 2026 to confirm that CVE-2025-14733, an unauthenticated RCE in the WatchGuard Firebox iked process patched back in December 2025, is now used in ransomware attacks. With nearly 9,000 Fireboxes still exposed online, check your Fireware OS version and hunt for the indicators of compromise before the encryption starts.