CVE-2026-13086

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

Score

CVSS 4.0 9.3 Critical

Status

Deferred - 5d1c2695-1a31-4499-88ae-e847036fd7e3

Published

2026-08-27

Last modified

2026-09-03

Weaknesses

CWE-121, CWE-787, CWE-798

Affected products

• Fireware Os (Watchguard)

References

• https://psirt.watchguard.com/CVE-2026-13086