CVE-2026-96293: Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local, unprivileged user or process on a managed macOS computer can exploit it. The affected system must use WatchGuard Endpoint Security's Full Disk Encryption feature.
What information could be exposed?
The managed computer's FileVault Personal Recovery Key could be obtained from a persistently written diagnostic log file that is readable by all local users.
How can I determine whether a system may be affected?
Check managed macOS systems using WatchGuard Endpoint Security Full Disk Encryption for a persistently written diagnostic log file with permissions allowing all local users to read it. Exposure is indicated if that log contains the FileVault Personal Recovery Key in cleartext.