CVE-2026-96293— Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
Quick assessment
Affected
WatchGuard WatchGuard Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WatchGuard Endpoint Security 针对 macOS 的全磁盘加密功能存在明文存储敏感信息的漏洞。该漏洞允许本地非特权用户或进程通过读取一个对所有本地用户可读的持久化诊断日志文件，获取受管理计算机的 FileVault 个人恢复密钥。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96293
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
Source: CVE Program / CVE List V5
Vulnerability Description
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WatchGuard | WatchGuard Agent | 1.17.24.0000 | - |
|
II. Public POCs for CVE-2026-96293
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96293
请登录查看更多情报信息。
Other References for CVE-2026-96293 (1)
-
https://psirt.watchguard.com/CVE-2026-96293 vendor-advisory
IV. Related Vulnerabilities
Same product: WatchGuard Agent
-
CVE-2026-115253
WatchGuard Agent Incorrect Permission Assignment in Log Dire -
CVE-2026-57910
WatchGuard Agent improper authentication allows unauthentica -
CVE-2026-57909
WatchGuard Agent path traversal allows unauthenticated remot -
CVE-2026-6788
Uncontrolled search path in PluginLauncher allows SYSTEM cod -
CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent
Same vendor: WatchGuard
-
CVE-2026-115253
WatchGuard Agent Incorrect Permission Assignment in Log Dire -
CVE-2026-13043
WatchGuard Endpoint Security Missing Authentication in Kerne -
CVE-2026-86134
Fireware OS Pre-Authentication NULL Pointer Dereference Allo -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API -
CVE-2026-18145
Fireware OS Stack-based Buffer Overflow in spamd Allows Remo
Same weakness: CWE-312
-
CVE-2026-114223
NewType Infortech｜NT OneAPP - Exposure of Sensitive Informat -
CVE-2025-7203
Sensitive Information Disclosure via Management Console and -
CVE-2026-111993
Soarkey StudentManagement AdminDao.java UserDao.login cleart -
CVE-2026-19864
Eclipse Jetty会话认证凭据明文存储漏洞 -
CVE-2026-105271
GEOアプリ明文存储敏感信息致密码泄露
V. Comments for CVE-2026-96293
No comments yet