{"id":"CVE-2026-96293","kind":"vulnerability","aliases":["CVE-2026-96293"],"related":[],"title":"WatchGuard Endpoint Security: macOS log leaks FileVault recovery keys locally","description":"A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.","summary":"WatchGuard Endpoint Security's Full Disk Encryption feature for macOS writes a diagnostic log file that is readable by all local users. A local unprivileged user or process can read it and obtain a managed computer's FileVault Personal Recovery Key.","severity":"medium","cvss":6.9,"epss":0.00051,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["filevault","full-disk-encryption","infrastructure","macos","watchguard-endpoint-security"],"not_affected_if":["no-macos-fde-feature","no-watchguard-endpoint-security"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T09:17:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:38:55+00:00","updated_at":"2026-10-25T03:38:55+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:38:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"WatchGuard Endpoint Security: macOS log leaks FileVault recovery keys locally","impact":"high","summary":"WatchGuard Endpoint Security's Full Disk Encryption feature for macOS writes a diagnostic log file that is readable by all local users. A local unprivileged user or process can read it and obtain a managed computer's FileVault Personal Recovery Key.","category":"infrastructure","nicknames":[],"who_cares":["macos","watchguard-endpoint-security","full-disk-encryption","filevault"],"confidence":0.7,"needs_auth":"no","worst_case":"Local user reads FileVault recovery key and unlocks the disk","analyst_note":"Find the WatchGuard advisory and fixed version, the log file path and how to confirm the log is world-readable; sources list only NVD and EPSS.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-watchguard-endpoint-security","no-macos-fde-feature"],"who_is_affected":"Macs managed by WatchGuard Endpoint Security with its Full Disk Encryption feature enabled are exposed, since the flaw is in that feature's diagnostic log. Teams that do not run WatchGuard Endpoint Security on macOS can skip it. Whether the vendor has shipped a patched build is not stated in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3370,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96293':13A,16A 'allow':87C 'cleartext':70C 'comput':63B,98C 'cve':11A,14A 'diagnost':40B,109C 'disk':20B,33B,82C 'encrypt':21B,34B,83C 'endpoint':2A,26B,29B,78C 'featur':35B,84C 'file':42B,111C 'filevault':7A,17B,65B,100C 'full':19B,32B,81C 'full-disk-encrypt':18B 'inform':74C 'infrastructur':22B 'key':9A,68B,103C 'leak':6A 'left':112C 'local':10A,48B,51B,89C,116C 'log':5A,41B,110C 'maco':4A,23B,37B,86C 'manag':62B,97C 'obtain':60B,95C 'persist':107C 'person':66B,101C 'process':55B,93C 'read':57B,105C 'readabl':45B,113C 'recoveri':8A,67B,102C 'secur':3A,27B,30B,79C 'sensit':73C 'storag':71C 'unprivileg':52B,90C 'user':49B,53B,91C,117C 'vulner':75C 'watchguard':1A,25B,28B,77C 'watchguard-endpoint-secur':24B 'write':38B 'written':108C","nicknames":[],"mitigations":[],"who_affected":"Macs managed by WatchGuard Endpoint Security with its Full Disk Encryption feature enabled are exposed, since the flaw is in that feature's diagnostic log. Teams that do not run WatchGuard Endpoint Security on macOS can skip it. Whether the vendor has shipped a patched build is not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96293","severity":null,"published_at":"2026-10-22T09:17:17+00:00","modified_at":"2026-10-23T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96293","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96293","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}