CVE-2026-13086

CriticalCVSS 9.3/10Last modified Sep 3, 2026

Description

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121 CWE-787 CWE-798

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.0, < 2026.2.2; >= 12.0, < 12.12.2; >= 2026.3, < 2026.3.1
WatchGuard	Fireware OS	>= 12.0, < 12.5.20

References

https://psirt.watchguard.com/CVE-2026-13086

Timeline

Published: Aug 28, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-130897.5OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verif CVE-2026-130947.8IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due CVE-2026-130978.7A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds dir CVE-2026-13105.3The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. T CVE-2026-131037.3A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a CVE-2026-131047.3A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenti CVE-2026-131058.8IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.CVE-2026-131077.1IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection CVE-2026-131088.7WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log list CVE-2026-13118.8The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup uploa CVE-2026-131105.3The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due CVE-2026-131135.3GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that