CVE-2026-96293 WatchGuard CVE debrief

Who should care

macOS system administrators and security teams responsible for managing WatchGuard Endpoint Security's Full Disk Encryption feature should assess exposure and verify log file permissions.

Why it matters

This vulnerability allows local, unprivileged users or processes to obtain sensitive information, specifically the FileVault Personal Recovery Key, from diagnostic log files left readable by all local users on macOS systems with WatchGuard Endpoint Security's Full Disk Encryption feature. System administrators and security teams should verify log file permissions, restrict access to sensitive information, and review WatchGuard Agent versions to ensure they are up-to-date.

• Local, unprivileged users or processes can access sensitive information.
• Diagnostic log files may be readable by all local users.
• FileVault Personal Recovery Key may be obtainable without proper authorization.

Technical summary

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users. The vulnerability is due to inadequate access controls on diagnostic log files, which can be exploited by local users to gain unauthorized access to sensitive information. This vulnerability affects macOS systems with WatchGuard Endpoint Security's Full Disk Encryption feature and can be mitigated by verifying log file permissions and restricting access to sensitive information.

Defensive priority

macOS systems with WatchGuard Endpoint Security's Full Disk Encryption feature should verify log file permissions and restrict access to sensitive information.

Recommended defensive actions

• Verify log file permissions and restrict access to sensitive information on macOS systems with WatchGuard Endpoint Security's Full Disk Encryption feature.
• Review and update WatchGuard Agent to version 1.17.23.0000 or later.
• Monitor for local, unprivileged users or processes attempting to access diagnostic log files.
• Conduct a thorough review of affected systems and apply necessary patches or mitigations.
• Implement compensating controls to restrict access to sensitive information.
• Track exceptions and retest remediated assets to ensure vulnerability resolution.
• Review asset inventory to identify potentially affected systems.

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. The source item and supplemental source provide additional context. The vulnerability has been reported in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS, allowing local, unprivileged users or processes to obtain a managed computer's FileVault Personal Recovery Key. Evidence is based on CVE Program and NVD records, as well as vendor advisory information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.