CVE-2026-13086: Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
Deferred
Published 27-08-2026Last modified 03-09-2026
Vulnerability summary
CVE-2026-13086 is a critical (CVSS 9.3) Stack-based Buffer Overflow vulnerability in watchguard fireware os. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities.
CVSS score
9.3/10
010
Critical · v4.0 (CVE.org)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 27-08-2026PublishedVulnerability first disclosed.
- 03-09-2026Last modifiedVulnerability information updated.
Description
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.44% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.
Affected systems
Watchguard1 product
- fireware os≥ 2025.0, < 2026.2.2 | ≥ 12.0, < 12.12.2 | ≥ 2026.3, < 2026.3.1 | ≥ 12.0, < 12.5.20
1 vendor · 1 product
References
1 links- psirt.watchguard.com/CVE-2026-13086Vendor Advisory