Vulnerability · Published Oct 22, 2026 · Assigned by WatchGuard

CVE-2026-96293Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

Medium 6.9

In plain English

A medium-severity sensitive data in logs in WatchGuard Agent from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)<0.1%top 100.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	WatchGuard Agent	0 – before 1.17.23.0000

Weakness: CWE-312, CWE-532, CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://psirt.watchguard.com/CVE-2026-96293 vendor-advisory