CVEvulnerability

CVE-2026-13086

9.3 CRITICAL Published 2026-08-28 Modified 2026-09-03 Official page ↗
Status
Deferred
Published
2026-08-28
Last modified
2026-09-03
Assigner
5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS 4.0 (5d1c2695-1a31-4499-88ae-e847036fd7e3)
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-121, CWE-787, CWE-798

Description

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

Related

Weakness · CWE (3)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References