WatchGuard TechnologiesCVE-2026-13086

WatchGuard Technologies Fireware OS: stack buffer overflow

Critical9.3CVE-2026-13086 · Published Aug 28, 2026 · updated Sep 3, 2026

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

WatchGuard Technologies advisory

Affected versions

Package	Affected	Fixed in
Fireware OS Product	>= 2025.0, < 2026.2.2	2026.2.2
	>= 12.0, < 12.12.2	12.12.2
	>= 2026.3, < 2026.3.1	2026.3.1
	>= 12.0, < 12.5.20	12.5.20

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-121, CWE-787, CWE-798

More WatchGuard Technologies advisories

All WatchGuard Technologies

Date	Advisory	Severity	Fixed in
Aug 28	WatchGuard Technologies Dimension: SQL injection High8.6Aug 28 CVE-2026-786142.3.1	High8.6	2.3.1
Aug 28	WatchGuard Technologies Dimension: cross-site scripting Medium4.6Aug 28 CVE-2026-786152.3.1	Medium4.6	2.3.1
Aug 28	WatchGuard Technologies Dimension: cross-site scripting Medium4.8Aug 28 CVE-2026-786162.3.1	Medium4.8	2.3.1
Aug 28	WatchGuard Technologies Dimension: observable discrepancy Medium6.3Aug 28 CVE-2026-786172.3.1	Medium6.3	2.3.1
Aug 28	WatchGuard Technologies Dimension: improper access control Medium6.9Aug 28 CVE-2026-786182.3.1	Medium6.9	2.3.1
Aug 28	WatchGuard Technologies Dimension: server-side request forgery Medium5.3Aug 28 CVE-2026-784952.3.1	Medium5.3	2.3.1

Affected versions

More WatchGuard Technologies advisories

Critical advisories by email