WatchGuard FireWare OS: Pre-Auth RCE in Endpoint Service

On September 9, 2026, the ZDI-26-632 advisory disclosed a critical vulnerability in WatchGuard FireWare OS. The flaw resides in the Endpoint Protection Manager (epm connect) service and allows a network-adjacent attacker to execute arbitrary code with root privileges without any authentication. WatchGuard released a corrective update approximately five months after private disclosure.

The Mechanism: How the Overflow Works on epm connect

The Endpoint Protection Manager service manages communication between the WatchGuard firewall and endpoints on the local network. According to the ZDI advisory, the specific vulnerability resides in this component: the software fails to properly validate the length of user-supplied data before copying it to a fixed-length stack-based buffer.

This missing validation allows exceeding the buffer boundaries, overwriting the function's return address, and diverting execution to attacker-controlled code. Because the service operates with elevated privileges, the result is execution in the context of root — the highest level of access on the system.

"The specific flaw exists within the Endpoint Protection Manager service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer." — ZDI Advisory ZDI-26-632

Attack Conditions: Who Can Exploit the Flaw

The ZDI advisory specifies that the attacker must be network-adjacent: it does not require an arbitrary remote position from the Internet, but must reside on the same local network as the target device. This constraint reduces the attack surface compared to a fully remote vulnerability, but does not eliminate it.

An attacker can position themselves on the same network through endpoint compromise, access to a shared guest Wi-Fi network, lateral movement from less protected VLANs, or physical presence. No authentication is required to exploit the vulnerability, removing any credential-based barrier. According to the source, "this vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability."

Why This Matters

The severity of the flaw extends beyond the single device. A firewall compromised with root privileges becomes a privileged attack platform inside the network: it can intercept traffic, modify filtering rules, redirect connections, or serve as a pivot point toward internal segments. The vulnerable component — Endpoint Protection Manager — is designed to orchestrate endpoint security, making its transformation into a compromise vector both ironic and particularly grave.

The advisory does not specify which network interfaces expose the epm connect service, nor how many FireWare OS installations have it enabled by default. These missing details leave open operational questions: administrators and analysts must independently verify whether the service is listening on interfaces reachable from the local network or only on restricted segments.

What to Do Now

Administrators of WatchGuard systems must apply the vendor-issued update for FireWare OS, as indicated in advisory ZDI-26-632. Verifying the exposure of the epm connect service on the local network is the first operational step: check whether the service is listening on interfaces accessible from untrusted segments, including guest Wi-Fi or VLANs with limited access.

It is necessary to verify the presence of any segmentation rules that isolate traffic to the Endpoint Protection Manager service. Reviewing network logs for anomalous connections to the ports used by epm connect helps identify exploitation attempts prior to patching. Priority goes to devices with the service exposed on interfaces with high attack surface, such as those facing shared networks or those with many endpoints.

Disclosure Timeline and Patch Status

The vulnerability was reported to WatchGuard on April 16, 2026. Coordinated release occurred on September 9, 2026, for a window of approximately five months between private report and public disclosure. WatchGuard issued a corrective update, as documented by the advisory.

CVE-2026-13086 was published on the same date as the coordinated release, confirming the formal existence of the vulnerability in the MITRE registry. The CVSS score and vector are not stated in the available ZDI advisory text; the CVE record does not provide additional technical details in the extracted material beyond the temporal correspondence.

Dossier Limits and Undocumented Points

The primary source does not specify the exact affected FireWare OS versions, the vulnerable buffer size, exploit offsets, or the presence of runtime mitigation techniques active on the binary. No evidence of in-the-wild exploitation emerges from the examined material. The source also does not detail whether the epm connect service is enabled by default, on which interfaces it listens, or whether configurations exist that limit its exposure without applying the full patch.

The dossier does not document specific corrective measures beyond the vendor-issued update. No explicit operational recommendations from ZDI emerge regarding compensating controls, workarounds, or verification of prior compromise.

Information is based on the cited source and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-632/
• https://www.cve.org/CVERecord?id=CVE-2026-13086
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html