← All advisories & CVEs

CVE-2026-96293

Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

Medium 6.9 CVSS v4.0 › Published 2026-10-22Updated 2026-10-22

Summary #

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

Product status #

ProductAffectedNot affected
WatchGuard Agent
macOS >= 0, < 1.17.24.0000>= 1.17.24.0000

Weakness Type and Impact #

  • CWECWE-312Cleartext Storage of Sensitive Information
  • CWECWE-532Insertion of Sensitive Information into Log File
  • CWECWE-732Incorrect Permission Assignment for Critical Resource
  • CAPECCAPEC-37Retrieve Embedded Sensitive Data
  • CAPECCAPEC-150Collect Data from Common Resource Locations

Solution #

Update to a fixed release per the affected-version ranges above.

References #

    Credits #

    • James Mcfinder

    View the canonical record on cve.org