CVE-2026-13086: CWE-121 in WatchGuard Fireware OS

This vulnerability is a stack-based buffer overflow (CWE-121) in the epm service used by the deprecated Mobile Security feature in WatchGuard Fireware OS. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code on affected systems. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions explicitly include =2025.0, =12.0, and =2026.3. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected Fireware OS devices. Given the critical CVSS score and remote unauthenticated attack vector, this poses a significant risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Mobile Security feature is deprecated, consider disabling it if possible as a temporary mitigation. Monitor WatchGuard advisories for official fixes or workarounds. Avoid exposing the epm service to untrusted networks until a fix is available.