CVE-2026-13086
Received
Published: 27 Aug 2026, 23:24
Last modified:27 Aug 2026, 23:24
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.3 CRITICAL
v4.0 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
27 Aug 2026, 23:24
Published
Vulnerability first disclosed
Description
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
CVSS Metrics
- v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Techniques & Countermeasures
- CWE-121•Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787•Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
- CWE-798•Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Affected Systems
- watchguard•fireware os
≥ 2025.0, < 2026.2.2 | ≥ 12.0, < 12.12.2 | ≥ 12.0, < 12.5.20