CVE-2026-13086

critical · 9.3

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

9.3

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2026-08-28

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-121CWE-787CWE-798

References

https://psirt.watchguard.com/CVE-2026-13086

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-13086