CVE-2026-13086

Summary

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

Affected Software

VendorProductVersion RangeStatus
WatchGuardFireware OS2025.0 < 2026.2.2affected
WatchGuardFireware OS12.0 < 12.12.2affected
WatchGuardFireware OS12.0 < 12.5.20affected

Weaknesses

  • CWE-121: CWE-121
  • CWE-787: CWE-787
  • CWE-798: CWE-798

References