Description
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WatchGuard | Fireware OS | 2025.0 – < 2026.2.2, 12.0 – < 12.12.2, 2026.3 – < 2026.3.1, 12.0 – < 12.5.20 | 2026.2.2 |
Advisories 2
- WID-SEC-2026-3068 WatchGuard Firebox OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 9, 2026
- NCSC-2026-0335 Kwetsbaarheden verholpen in WatchGuard Fireware OS NCSC-NL (Netherlands) · Sep 1, 2026
References
- https://psirt.watchguard.com/CVE-2026-13086 vendor-advisory