Stack-Based Buffer Overflow in WatchGuard Fireware OS Endpoint Protection Manager
CVE-2026-13086

9.3CRITICAL

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
27 August 2026

Badges

👾 Exploit Exists

What is CVE-2026-13086?

A security vulnerability exists in the Endpoint Protection Manager service of WatchGuard Fireware OS, specifically related to the deprecated Mobile Security feature. This vulnerability can be exploited by unauthenticated remote attackers to execute arbitrary code, potentially compromising the affected system. The flaw results from improper handling of memory allocation, leading to a buffer overflow condition.

Affected Version(s)

Fireware OS Default 2025.0 < 2026.2.2

Fireware OS Default 12.0 < 12.12.2

Fireware OS Default 2026.3 < 2026.3.1

References

https://psirt.watchguard.com/CVE-2026-13086
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mat Powell of TrendAI Zero Day Initiative
.