WatchGuard Firebox Has a 9.3 RCE. The Old Mobile Security Service Is the Door

• The Mess: WatchGuard Firebox ships with a critical stack overflow in the deprecated Mobile Security epm service. A crafted JSON-RPC request can overwrite the return address and execute code as root.
• The Damage: An attacker who can reach the trusted interface can turn the firewall into a root-level execution target without credentials.
• The Fix: Update Fireware immediately and disable the deprecated Mobile Security feature if it is still enabled.

Firewalls are supposed to be the thing attackers have to get past.

CVE-2026-13086 gives them something more interesting to attack.

The flaw sits inside the epm Endpoint Protection Manager service used by WatchGuard’s deprecated Mobile Security feature. It is a stack-based buffer overflow that can be triggered with a specially crafted JSON-RPC request.

The vulnerable process does not require authentication.

And when exploitation succeeds, the attacker gets arbitrary code execution with root privileges.

The Old Service Became the Attack Surface

The vulnerable component is not some shiny new cloud feature.

It is part of an old Mobile Security service that administrators may have forgotten even exists.

That makes this type of vulnerability particularly nasty operationally. Legacy components tend to survive because nobody wants to touch them until something breaks.

Here, the service contains a stack overflow and runs with enough privilege to make successful exploitation extremely serious.

WatchGuard says the vulnerable epm service is reachable by default only through Trusted interfaces and only when the deprecated Mobile Security feature is enabled.

So this is not automatically an Internet-wide unauthenticated RCE against every Firebox.

But trusted-network access is still a valuable position for an attacker.

The Exploit Primitive Is Straightforward

CVE-2026-13086 carries a CVSS 4.0 score of 9.3 Critical.

The official vector specifies:

• network attack vector;
• low attack complexity;
• no attack requirements;
• no privileges required;
• no user interaction;
• high confidentiality impact;
• high integrity impact;
• high availability impact.

WatchGuard also notes that the vulnerable binary lacks a stack canary and uses a non-PIE configuration, making return-oriented programming considerably easier.

Even an unsuccessful attack can crash the epm process and cause a denial of service until the service respawns.

That is a surprisingly generous exploitation environment for a firewall component.

Patch Versions

WatchGuard fixed the vulnerability in:

• Fireware OS 2026.3.1
• Fireware OS 2026.2.2
• Fireware OS 12.12.2
• Fireware OS 12.5.20

Affected ranges include Fireware 2025.0 through versions before 2026.2.2, 12.0 through versions before 12.12.2, and 2026.3 before 2026.3.1. T15/T35 appliances have their own affected range ending before 12.5.20.

WatchGuard released the patches on August 27 and explicitly urged customers to update Firebox appliances immediately.

No Exploitation Seen Yet

There is currently no evidence from WatchGuard that CVE-2026-13086 is being exploited in the wild.

That should not be interpreted as a reason to wait.

The vulnerability was found by Mat Powell of TrendAI Zero Day Initiative, and the technical conditions are already well defined: network-reachable service, no authentication, stack overflow, predictable exploitation primitives and root execution.

The dangerous window is the time between disclosure and attackers turning those ingredients into a working exploit.

Bugstoday Opinion

The funniest part is that this vulnerability lives in a deprecated security feature.

Deprecated does not mean gone.

If the code is still installed, reachable and running with root privileges, attackers don’t care whether the marketing department stopped talking about it three years ago.

Firewalls accumulate forgotten services.

Forgotten services accumulate vulnerabilities.

And eventually someone finds the door.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

WatchGuard PSIRT — CVE-2026-13086

CVE.org — CVE-2026-13086

WatchGuard Product & Support News — Firebox security update

TrendAI Zero Day Initiative — vulnerability discovery