CVE-2026-13086CWE-121CWE-787CWE-798hardcoded-credentials

CVE-2026-13086

published August 28, 2026

CVSS
9.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00441 · 37.3th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-787 · Out-of-bounds Write; CWE-798 · Use of Hard-coded Credentials
Published
2026-08-28T06:16Z
References (1)
https://psirt.watchguard.com/CVE-2026-13086 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 27 AUG 23:24Z
    Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
    cvelistv5