ZDI-CAN-30460: ZDI-26-632: WatchGuard FireWare OS epm connect Stack-based Buffer Overflow Remote Code Execution Vulnerability
Published Sep 9, 2026
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-13086.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 9, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Who is exposed to exploitation?
Affected WatchGuard FireWare OS installations reachable by a network-adjacent attacker are exposed. The available information does not require the attacker to authenticate.
2
What level of access does an attacker need?
An attacker needs network-adjacent access to the affected installation. No authentication is required, and successful exploitation can result in arbitrary code execution.
3
How severe is this issue?
ZDI assigned this vulnerability a CVSS score of 8.8. It is tracked as CVE-2026-13086.