External risk intelligence

WatchGuard Fireware OS epm Service Stack Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-13086

The vulnerability affects an endpoint protection management service within a network security appliance (WatchGuard Fireware OS). Such appliances are designed to operate at the internet edge, and their management and security services are typically exposed to the network to perform their primary function of protecting and monitoring traffic.

Out-of-bounds Write

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in WatchGuard Fireware OS, specifically within the deprecated Mobile Security feature's epm service. This issue could allow an unauthenticated remote attacker to execute arbitrary code, posing a significant risk to the integrity and confidentiality of network security operations. The primary concern at this stage is to confirm whether this technology is in use and the extent of any potential exposure.

Code execution flaw in a security service.
Affects network protection services at the edge.
Confirm use and exposure; assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a stack-based buffer overflow in the epm service, which is part of WatchGuard's deprecated Mobile Security feature. This vulnerability is accessible remotely and does not require authentication, allowing an attacker to potentially execute arbitrary code on the affected system.

Unauthenticated remote access required.
Triggered by interacting with the epm service.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in the epm service, part of the deprecated Mobile Security feature in WatchGuard Fireware OS, could allow an unauthenticated remote attacker to execute arbitrary code. This exposure is possible when the service is accessible over the network.

Arbitrary code execution on the affected system.
Network-accessible service allows remote code injection.
Compromise of device integrity and data confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WatchGuard Fireware OS's deprecated Mobile Security feature's epm service requires immediate attention from infrastructure and security teams. The first practical step is to identify all instances of the affected technology, determine their network exposure and business criticality, and then locate the accountable owner to prioritize remediation efforts.

Infrastructure and security teams own this.
Verify network exposure and criticality.
Plan and coordinate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the epm service in WatchGuard Fireware OS?

The epm service stands for Endpoint Protection Manager. It was a component used by the Mobile Security feature within WatchGuard Fireware OS. While this feature is now deprecated, the service code remains present in the operating system, serving as a legacy component that formerly handled endpoint security management tasks on the network appliance.

What does CWE-121 mean for CVE-2026-13086?

CWE-121 refers to a stack-based buffer overflow. This is a memory-related weakness where a program writes more data to a specific area of memory (the stack) than it is designed to hold. Because the epm service fails to properly check the size of incoming data, an attacker can overwrite adjacent memory, which allows them to redirect the program's execution flow and run unauthorized code.

How can an attacker trigger this buffer overflow?

An attacker triggers this by sending specially crafted, malicious network traffic directly to the epm service. Because the vulnerability is reachable without authentication, the attacker does not need a username or password to initiate the process. Simply having access to the service over the network is sufficient; if the service is disabled or blocked from receiving external input, the trigger path is effectively closed.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is classified as 'Very likely' to be relevant. Because WatchGuard Fireware OS appliances are typically deployed at the network edge to monitor and protect traffic, their management services are often exposed to the internet. If your device is internet-facing, it is in a position where an attacker could reach the vulnerable service.

What should I do first to address this vulnerability?

Your first step is to perform an inventory of your WatchGuard appliances to see if they are running a version of Fireware OS that includes the epm service. Once identified, verify if the service is active and assess its network accessibility. Coordinate with your team to determine the criticality of these devices and prioritize them for remediation steps provided by the vendor.

References

psirt.watchguard.com/CVE-2026-13086

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.