CVE-2026-13086 (GCVE-0-2026-13086)
Vulnerability from cvelistv5
Published
2026-08-27 23:24
Modified
2026-08-29 03:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| WatchGuard | Fireware OS |
Version: 2025.0 < 2026.2.2 Version: 12.0 < 12.12.2 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13086",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T03:55:57.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Default"
],
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "2026.2.2",
"status": "affected",
"version": "2025.0",
"versionType": "custom"
},
{
"lessThan": "12.12.2",
"status": "affected",
"version": "12.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"T15/T35"
],
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "12.5.20",
"status": "affected",
"version": "12.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBy default, the epm service is only reachable on Trusted interfaces on devices where the deprecated Mobile Security is enabled.\u003c/p\u003e"
}
],
"value": "By default, the epm service is only reachable on Trusted interfaces on devices where the deprecated Mobile Security is enabled."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.5.20",
"versionStartIncluding": "12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.2.2",
"versionStartIncluding": "2025.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.12.2",
"versionStartIncluding": "12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat Powell of TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-787",
"description": "CWE-787",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T23:24:32.779Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.watchguard.com/CVE-2026-13086"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fireware OS 2026.2.2, Fireware OS 12.12.2, Fireware OS 12.5.20"
}
],
"value": "Fireware OS 2026.2.2, Fireware OS 12.12.2, Fireware OS 12.5.20"
}
],
"title": "Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2026-13086",
"datePublished": "2026-08-27T23:24:32.779Z",
"dateReserved": "2026-06-23T18:45:34.589Z",
"dateUpdated": "2026-08-29T03:55:57.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13086\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-28T17:31:36.229065Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-28T17:32:43.738Z\"}}], \"cna\": {\"title\": \"Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mat Powell of TrendAI Zero Day Initiative\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}}], \"affected\": [{\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025.0\", \"lessThan\": \"2026.2.2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.12.2\", \"versionType\": \"custom\"}], \"platforms\": [\"Default\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.5.20\", \"versionType\": \"custom\"}], \"platforms\": [\"T15/T35\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"WatchGuard is not aware of any exploitation of this vulnerability in the wild.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"WatchGuard is not aware of any exploitation of this vulnerability in the wild.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Fireware OS 2026.2.2, Fireware OS 12.12.2, Fireware OS 12.5.20\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Fireware OS 2026.2.2, Fireware OS 12.12.2, Fireware OS 12.5.20\", \"base64\": false}]}], \"references\": [{\"url\": \"https://psirt.watchguard.com/CVE-2026-13086\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"By default, the epm service is only reachable on Trusted interfaces on devices where the deprecated Mobile Security is enabled.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eBy default, the epm service is only reachable on Trusted interfaces on devices where the deprecated Mobile Security is enabled.\u003c/p\u003e\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.5.20\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2026.2.2\", \"versionStartIncluding\": \"2025.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.12.2\", \"versionStartIncluding\": \"12.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"shortName\": \"WatchGuard\", \"dateUpdated\": \"2026-08-27T23:24:32.779Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-13086\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-29T03:55:57.210Z\", \"dateReserved\": \"2026-06-23T18:45:34.589Z\", \"assignerOrgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"datePublished\": \"2026-08-27T23:24:32.779Z\", \"assignerShortName\": \"WatchGuard\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…