---
id: CVE-2026-96293
title: Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
summary: >-
  A cleartext storage of sensitive information vulnerability in WatchGuard
  Endpoint Security's Full Disk Encryption feature for macOS allows a local,
  unprivileged user or process to obtain a managed computer's FileVault Personal
  Recovery K…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-312
  - CWE-532
  - CWE-732
vendor: WatchGuard
product: WatchGuard Agent
affected:
  - agent < 1.17.24.0000
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:47:24.559Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-96293'
references:
  - url: 'https://psirt.watchguard.com/CVE-2026-96293'
tags:
  - cve.org
ingestedAt: '2026-10-22T09:34:48.709Z'
---

## Overview

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

## Affected

- `agent < 1.17.24.0000`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.