EUVD-2026-67334
GHSA-c7m7-329m-9vph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Firebox over network
-
DeliverySend crafted request to epm service
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionHijack control flow
-
PersistExecute arbitrary code on appliance
-
ImpactEstablish perimeter foothold
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the deprecated Mobile Security feature (and its epm / Endpoint Protection Manager service) be present and reachable on the target Fireware OS appliance - that is the concrete gating prerequisite. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity, so against an appliance with that service exposed, exploitation is remote and unauthenticated. The primary limiting factor is deployment configuration: appliances that never enabled or have removed the deprecated Mobile Security feature should not expose the vulnerable service, and network segmentation restricting reachability of the epm port further limits practical exposure. |
| Impact | All strong signals point to high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes unauthenticated, low-complexity, network-reachable exploitation with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), scoring 9.3. Because the target is a security perimeter device, successful RCE yields a foothold at the network edge - the worst possible location. Countervailing factors temper widespread urgency: no public exploit or POC is identified, the CVE is not in CISA KEV, EPSS is not provided, and the affected service belongs to a deprecated Mobile Security feature, so exposure is limited to appliances still running that configuration rather than the entire Firebox install base. The realistic reading is a critical-but-conditional issue: organizations that never used Mobile Security are likely unaffected, while those that did should patch immediately and treat it as urgent given the appliance's exposure and the absence of authentication. |
| Exploit ScenarioDerived | An attacker who can reach the Firebox appliance over the network sends a crafted request to the epm service, overflowing a stack buffer to hijack control flow and execute arbitrary code on the appliance with no authentication or user interaction. Because the appliance sits at the network perimeter, this yields an immediate edge foothold for pivoting inward. No public POC is currently identified, so exploitation would require the attacker to develop the overflow independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
RemediationAI
Patch available per vendor advisory: apply the fixed Fireware OS release published by WatchGuard in the PSIRT advisory at https://psirt.watchguard.com/CVE-2026-13086 (the input does not include an exact fix version, so confirm the target build in that advisory before upgrading). As a compensating control until patched, disable the deprecated Mobile Security feature so the vulnerable epm service is not active, since it is deprecated this should have minimal operational impact for most deployments. Additionally restrict network reachability of the epm service by blocking or firewalling its listening port from untrusted networks and limiting management/endpoint interfaces to trusted segments; the trade-off is that legitimate Mobile Security clients (if any remain) would lose connectivity, which is acceptable given the feature's deprecated status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fireware OS is the firmware running on WatchGuard Firebox network security appliances (CPE cpe:2.3:a:watchguard:fireware_os). The flaw is CWE-121, a stack-based buffer overflow: attacker-controlled input reaching the epm service overruns a fixed-size stack buffer, corrupting the return address or adjacent stack data and allowing hijack of control flow. The vulnerable code path lives in the Endpoint Protection Manager service associated with the Mobile Security feature, which WatchGuard has marked deprecated - meaning the exposed service may still be present and reachable on appliances that historically enabled or retained that feature.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable service (AV:N/PR:N/UI:N) with a low-complexity stack overflow yielding full code execution, so C/I/A all High; scope unchanged.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Zero Day Initiative Advisories
Executive ViewAI
WatchGuard Fireware OS contains a critical unauthenticated remote code execution vulnerability (CVSS 9.3) in the Mobile Security endpoint protection service, with no vendor patch currently available. Perimeter firewall compromise represents a loss of security boundary controls, potential internal network access, and data exfiltration risk for any organization running this service. Immediate containment and urgent vendor engagement is required.
No vendor-released patch identified at time of analysis. Disable the Mobile Security (epm) feature entirely if not operationally required. Implement strict network-based access controls limiting inbound connections to firewall management interfaces to trusted administrative segments only. Deploy IDS/IPS signatures and behavioral monitoring to detect anomalous epm service activity. Enable comprehensive logging and alerting on firewall telemetry with weekly manual review for indicators of compromise. Maintain isolated, encrypted recovery credentials for incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB