WatchGuard Endpoint Security CVE-2026-96293

Requires: (1) a local account or process on a macOS endpoint running WatchGuard Endpoint Security with the Full Disk Encryption feature actively managing FileVault; and (2) the diagnostic log file to have been persistently written with world-readable permissions containing the FileVault Personal Recovery Key. No authentication beyond being any local user/process is needed (PR:N). LIMITING FACTORS: exploitation is local-only (AV:L) - there is no network or remote path, so the attacker must already have a foothold on the machine; the managed Mac must have gone through FDE/FileVault enrollment that generated and logged the recovery key, meaning endpoints not managed by this feature are unaffected.

This is a locally-exploitable information-disclosure flaw (CWE-312) whose CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H) is internally consistent with the description: no privileges or user interaction are required, but the attacker must already be a local user or process on the affected macOS machine. The high confidentiality impact (VC:H) is justified because the exposed asset is the FileVault Personal Recovery Key, which can unlock the entire encrypted disk and thereby defeats the primary purpose of Full Disk Encryption. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact breakdown was supplied in the input, so exploitation-probability and automation signals cannot be weighed. The vuln.today decision label is 'this_month' (not act_now/emergency), and the only reference is the vendor's own PSIRT advisory - WatchGuard self-reported the issue, which typically indicates coordinated disclosure rather than observed in-the-wild abuse. Net: this is a genuine but bounded priority - the base score (6.9, medium) and local-only vector argue against emergency treatment, yet the sensitivity of the leaked recovery key and the 'this_month' label warrant prompt patching, especially on shared or multi-user Macs. The main missing signals are EPSS and any POC/KEV confirmation.

On a managed macOS endpoint where WatchGuard Full Disk Encryption has enrolled FileVault, any local non-privileged user or background process reads the world-readable diagnostic log file and extracts the FileVault Personal Recovery Key written there in cleartext. With that key the attacker (or a thief who later obtains the disk) can unlock the full-disk-encrypted volume, completely undermining FileVault. No public exploit identified at time of analysis; exploitation requires only standard file-read access, so no special tooling is needed.