Description
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Published: 2026-08-27
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow in the Endpoint Protection Manager service used by the deprecated Mobile Security feature in WatchGuard Fireware OS. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on the device, potentially gaining full control of the operating system.

Affected Systems

WatchGuard Fireware OS appliances that include the Mobile Security (epm) service are affected. The issue exists in versions prior to the official fixes released in Fireware OS 2026.2.2, 12.12.2, and 12.5.20.

Risk and Exploitability

The CVSS score of 9.3 classifies this as a critical flaw. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the data, but the flaw allows remote code execution without authentication, and it is not currently listed in CISA’s KEV catalog. The likely attack vector is a remote, unauthenticated client reaching the epm service over the network, which is inferred from the description.

Generated by OpenCVE AI on August 28, 2026 at 06:15 UTC.

Remediation

Vendor Solution

Fireware OS 2026.2.2, Fireware OS 12.12.2, Fireware OS 12.5.20

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to Fireware OS 2026.2.2, 12.12.2, or 12.5.20.
  • If an upgrade cannot be performed immediately, disable the Mobile Security feature to remove the vulnerable epm service.
  • Restrict external network access to the epm service by implementing firewall segmentation and ensuring that only trusted hosts can reach the epm interface.

Generated by OpenCVE AI on August 28, 2026 at 06:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Title Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-121
CWE-787
CWE-798
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-08-27T23:24:32.779Z

Reserved: 2026-06-23T18:45:34.589Z

Link: CVE-2026-13086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T02:16:20.197

Modified: 2026-08-28T02:16:20.197

Link: CVE-2026-13086

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T06:30:18Z

Weaknesses